git: 3f39713e4e34 - main - pf: log reused states in addition to failed state insertions
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 16 Apr 2025 18:02:54 UTC
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=3f39713e4e34f1de02f81f1dcf7a40f1a81c633e commit 3f39713e4e34f1de02f81f1dcf7a40f1a81c633e Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2025-04-16 07:46:15 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2025-04-16 14:23:48 +0000 pf: log reused states in addition to failed state insertions To assist debugging TCP connection reuse with NAT, expand the existing log in pf_state_key_attach() from the failed to the reuse case. OK mikeb@ Obtained from: OpenBSD, bluhm <bluhm@openbsd.org>, 3cd642e673 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index b6525b229c48..97d332bd348c 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1467,9 +1467,35 @@ keyattach: si->key[PF_SK_STACK]->af && sk->af == si->key[PF_SK_STACK]->af && si->direction != s->direction))) { + bool reuse = false; + if (sk->proto == IPPROTO_TCP && si->src.state >= TCPS_FIN_WAIT_2 && - si->dst.state >= TCPS_FIN_WAIT_2) { + si->dst.state >= TCPS_FIN_WAIT_2) + reuse = true; + + if (V_pf_status.debug >= PF_DEBUG_MISC) { + printf("pf: %s key attach " + "%s on %s: ", + (idx == PF_SK_WIRE) ? + "wire" : "stack", + reuse ? "reuse" : "failed", + s->kif->pfik_name); + pf_print_state_parts(s, + (idx == PF_SK_WIRE) ? + sk : NULL, + (idx == PF_SK_STACK) ? + sk : NULL); + printf(", existing: "); + pf_print_state_parts(si, + (idx == PF_SK_WIRE) ? + sk : NULL, + (idx == PF_SK_STACK) ? + sk : NULL); + printf("\n"); + } + + if (reuse) { /* * New state matches an old >FIN_WAIT_2 * state. We can't drop key hash locks, @@ -1486,25 +1512,6 @@ keyattach: si->timeout = PFTM_PURGE; olds = si; } else { - if (V_pf_status.debug >= PF_DEBUG_MISC) { - printf("pf: %s key attach " - "failed on %s: ", - (idx == PF_SK_WIRE) ? - "wire" : "stack", - s->kif->pfik_name); - pf_print_state_parts(s, - (idx == PF_SK_WIRE) ? - sk : NULL, - (idx == PF_SK_STACK) ? - sk : NULL); - printf(", existing: "); - pf_print_state_parts(si, - (idx == PF_SK_WIRE) ? - sk : NULL, - (idx == PF_SK_STACK) ? - sk : NULL); - printf("\n"); - } s->timeout = PFTM_UNLINKED; if (idx == PF_SK_STACK) /*