On Tue, Nov 20, 2007 at 10:50:41AM +0100, Jan Srzednicki wrote:
> And the state becomes:
>
> self tcp MY_IP_HERE:12525 <- MY_IP_HERE:64829 ESTABLISHED:FIN_WAIT_2
> [390096685 + 66608] wscale 1 [3173294128 + 66608] wscale 1
> age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30
> id: 47207d980002e600 creatorid: 082298e6
> self tcp MY_IP_HERE:64829 -> MY_IP_HERE:12525 FIN_WAIT_2:ESTABLISHED
> [3173294128 + 66608] wscale 1 [390096685 + 66608] wscale 1
> age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30
> id: 47207d980002e5ff creatorid: 082298e6
That's fine so far, ESTABLISHED:FIN_WAIT_2 is correct in this case.
Look at your /usr/src/sys/contrib/pf/net/pf.c, in pf_test_state_tcp()
there's a section like
/* update expire time */
(*state)->expire = time_second;
if (src->state >= TCPS_FIN_WAIT_2 &&
dst->state >= TCPS_FIN_WAIT_2)
(*state)->timeout = PFTM_TCP_CLOSED;
else if (src->state >= TCPS_CLOSING &&
dst->state >= TCPS_CLOSING)
(*state)->timeout = PFTM_TCP_FIN_WAIT;
else if (src->state < TCPS_ESTABLISHED ||
dst->state < TCPS_ESTABLISHED)
(*state)->timeout = PFTM_TCP_OPENING;
else if (src->state >= TCPS_CLOSING ||
dst->state >= TCPS_CLOSING)
(*state)->timeout = PFTM_TCP_CLOSING;
else
(*state)->timeout = PFTM_TCP_ESTABLISHED;
In 6.2-release this was, according to
http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/contrib/pf/net/pf.c?rev=1.34.2.4;content-type=text%2Fplain
/* update expire time */
(*state)->expire = time_second;
if (src->state >= TCPS_FIN_WAIT_2 &&
dst->state >= TCPS_FIN_WAIT_2)
(*state)->timeout = PFTM_TCP_CLOSED;
else if (src->state >= TCPS_FIN_WAIT_2 ||
dst->state >= TCPS_FIN_WAIT_2)
(*state)->timeout = PFTM_TCP_FIN_WAIT;
else if (src->state < TCPS_ESTABLISHED ||
dst->state < TCPS_ESTABLISHED)
(*state)->timeout = PFTM_TCP_OPENING;
else if (src->state >= TCPS_CLOSING ||
dst->state >= TCPS_CLOSING)
(*state)->timeout = PFTM_TCP_CLOSING;
else
(*state)->timeout = PFTM_TCP_ESTABLISHED;
Note the slight difference, which explains your observations.
It looks like this change was never backported/merged to RELENG_6.
Try the newer (first) version, it should resolve your problem.
Daniel
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
