From nobody Wed Jan 24 10:16:43 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TKfy93RNgz57y7v; Wed, 24 Jan 2024 10:16:49 +0000 (UTC) (envelope-from tuexen@freebsd.org) Received: from drew.franken.de (mail-n.franken.de [193.175.24.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "*.franken.de", Issuer "Sectigo RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TKfy9022tz472q; Wed, 24 Jan 2024 10:16:49 +0000 (UTC) (envelope-from tuexen@freebsd.org) Authentication-Results: mx1.freebsd.org; none Received: from smtpclient.apple (unknown [IPv6:2a02:8109:1140:c3d:e94b:5726:154f:104e]) (Authenticated sender: micmac) by drew.franken.de (Postfix) with ESMTPSA id E6F85721E280D; Wed, 24 Jan 2024 11:16:43 +0100 (CET) Content-Type: text/plain; charset=us-ascii List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.400.31\)) Subject: Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing From: tuexen@freebsd.org In-Reply-To: <87sf2nm4et.wl-herbert@gojira.at> Date: Wed, 24 Jan 2024 11:16:43 +0100 Cc: Kristof Provost , "src-committers@freebsd.org" , "dev-commits-src-all@freebsd.org" , "dev-commits-src-main@freebsd.org" Content-Transfer-Encoding: quoted-printable Message-Id: <413C7C6F-8B6F-4EAD-8EF7-7C9245BE78BF@freebsd.org> References: <202401221252.40MCqpf6047526@gitrepo.freebsd.org> <87v87jkii9.wl-herbert@gojira.at> <1E1C3472-0AF3-457B-A27A-89679770EA62@FreeBSD.org> <87sf2nm4et.wl-herbert@gojira.at> To: "Herbert J. Skuhra" X-Mailer: Apple Mail (2.3774.400.31) X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, T_SCC_BODY_TEXT_LINE autolearn=disabled version=3.4.1 X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on mail-n.franken.de X-Rspamd-Queue-Id: 4TKfy9022tz472q X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:680, ipnet:193.174.0.0/15, country:DE] > On Jan 24, 2024, at 11:06, Herbert J. Skuhra = wrote: >=20 > On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote: >>=20 >> On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote: >>> On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote: >>>>=20 >>>> The branch main has been updated by kp: >>>>=20 >>>> URL: = https://cgit.FreeBSD.org/src/commit/?id=3D54c62e3e5d8cd90c5571a1d4c8c5f062= d580480e >>>>=20 >>>> commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> Author: Kristof Provost >>>> AuthorDate: 2024-01-17 17:11:27 +0000 >>>> Commit: Kristof Provost >>>> CommitDate: 2024-01-22 11:52:14 +0000 >>>>=20 >>>> pf: work around icmp6 packet-too-big not being sent when = binat-ing >>>>=20 >>>> If we're applying NPTv6 we pass a packet with a modified source = and/or >>>> destination address to the network stack. >>>>=20 >>>> If that packet then turns out to be larger than the MTU of the = sending >>>> interface the stack will attempt to generate an icmp6 = packet-too-big >>>> error, but may fail to look up the appropriate source address for = that >>>> error message. Even if it does, pf would still have to undo the = binat >>>> operation inside the icmp6 packet so the sending host can make = sense of >>>> the error. >>>>=20 >>>> We can avoid both problems entirely by having pf also perform the = MTU >>>> check (taking the potential refragmentation into account), and >>>> generating the icmp6 error directly in pf. >>>>=20 >>>> See also: https://redmine.pfsense.org/issues/14290 >>>> Sponsored by: Rubicon Communications, LLC ("Netgate") >>>> Differential Revision: https://reviews.freebsd.org/D43499 >>>> --- >>>> sys/net/pfvar.h | 1 + >>>> sys/netpfil/pf/pf.c | 12 ++++++++++++ >>>> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ >>>> 3 files changed, 28 insertions(+) >>>=20 >>> Does this change cause problems for others too? >>>=20 >>> - ssh over IPv6 permanently disconnecting >>> (client_loop: send disconnect: Broken pipe) >>> - ssh connections over IPv6 hanging >>> - git pull not working >>> Fssh_ssh_dispatch_run_fatal: Connection to = 2604:1380:4091:a001::24ca:1 port 22: Permission denied >>> fatal: Could not read from remote repository. >>>=20 >> Can you include your pf.conf and a packet capture demonstrating one = of these issues? >=20 > So I assume this issue affects only me or this server (igb nic).=20 > Disabling tso6 seems to resolve the issue. >=20 > I also have an issue with rack enabled. I only works with lro disabled > or net.inet.tcp.rack.features.cmpack=3D0. I think I know what the issue is (some hooks are not called when in the = compressed ack code path), some dtrace probes are also affected. I'm working on a fix for that. Best regards Michael >=20 > I'll check pf.conf and packet capture later. >=20 > Thanks. >=20 > -- > Herbert