Fwd: pf problems

[Max Laier]

On Thursday 11 August 2005 17:35, Sergey Lapin wrote:
> > ****************************************************
> > ***************** Bug#3 (critical) *****************
> > ****************************************************
> >
> > Because route-to for "out" rules did not work well, we decided to add
> > the redirection for "in" rules so we added
> >
> > pass in quick on $dmz_if route-to ($ext_if1 $ext_gw1) tagged
> > DMZ_TO_EXT1 keep state
> > pass in quick on $dmz_if route-to ($ext_if2 $ext_gw2) tagged
> > DMZ_TO_EXT2 keep state
> >
> > right before before "pass out quick" rules. Everything started working
> > right and it worked fine for some time but then firewall died (machine
> > do not respond to keyboard and the only bring it back to live was to
> > bounce power). After rebooting situation repeated - router was working
> > well for 2 to 10 minutes and then unexpectedly freeze. We discovered
> > that problem was caused by broadcast UDP packet coming on dmz_if and
> > destined to 255.255.255.255 Later we discovered that this situation is
> > triggered by any packet for which both conditions are true:
> > 1. destination MAC is broadcast
> > 2. destination IP is none of router's directly connected networks
> >
> > Any such a packet kills the router. Actually, router is not completely
> > dead - it sends that damn packet over and over at huge speed to the
> > outer interface.
> >
> > Even if I'm doing something completely wrong, router should NOT hang that
> > way.

> Okay, we tested FreeBSD 5.4, FreeBSD 6.0 and OpenBSD 3.7

Thanks for doing this research.  Appreciated!

> Bug #2 present everywhere. Which means it is pf bug (or misfeature)

I'll leave that to the OpenBSD guys for the moment ...

> Bug #3 is definitely FreeBSD specific - it does not hurt OpenBSD.

... and focus on this one.  You told in an earlier mail that you have been 
able to break to DDB while hung?  Can you get a couple of traces from that 
machine so that we get an idea where we are spinning?  Just break into the 
debugger, issue a "trace" followed by a "continue", break again, repeat.  
Finnally you should make sure that you have a "interesting" trace (i.e. 
something with pf_* functions) and "call doadump".  On reboot secure the core 
and get back to me.

Thanks for your investigation and help!

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20050811/1b9d15f2/attachment.bin