Re: routing LAN traffic through/around a pf gateway

2019-01-24 Thread Kristof Provost
On 25 Jan 2019, at 9:37, James B. Byrne via freebsd-pf wrote: I have limited knowledge of PF being in the process of transitioning from 20+ years of RHEL/CentOS to FreeBSD. Neither do I possess a great fund of knowledge respecting IP routing. That said this is my problem: On a small test

Re: rdr pass for proto tcp sometimes creates states with expire time zero and so breaking connections

2019-01-24 Thread Andreas Longwitz
>> I think the problem is the cmpxchg8b instruction used in >> counter_u64_fetch(), because this machine instruction always writes to >> memory, also when we only want to read and have (EDX:EAX) = (ECX:EBX): >> >> TEMP64 <- DEST >> IF (EDX:EAX = TEMP64) >>THEN >> ZF <- 1

Re: rdr pass for proto tcp sometimes creates states with expire time zero and so breaking connections

2019-01-24 Thread Konstantin Belousov
[Keep me in Cc:] On Thu, Jan 24, 2019 at 05:49:46PM +0100, Andreas Longwitz wrote: > after some more long term research I have an educated guess whats going > on in this problem. > > The problem only occurs on i386. > > If I replace the counter_u64_fetch() call in pf_state_expires() by > the

routing LAN traffic through/around a pf gateway

2019-01-24 Thread James B. Byrne via freebsd-pf
I have limited knowledge of PF being in the process of transitioning from 20+ years of RHEL/CentOS to FreeBSD. Neither do I possess a great fund of knowledge respecting IP routing. That said this is my problem: On a small test LAN I have three hosts, W44, W4 and G5: network layout, gateway

Re: rdr pass for proto tcp sometimes creates states with expire time zero and so breaking connections

2019-01-24 Thread Andreas Longwitz
after some more long term research I have an educated guess whats going on in this problem. The problem only occurs on i386. If I replace the counter_u64_fetch() call in pf_state_expires() by the value of V_pf_status.states, then pf works without problems, the expire time zero problem is gone:

[Bug 229092] [pf] [pfsync] States created by route-to rules pfsynced without interface

2019-01-24 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=229092 --- Comment #18 from Kajetan Staszkiewicz --- My 2nd patch stores missing state->rt information in currently unused part of struct pfsync_state. That should make it compatible. A router running non-patched kernel will simply not transmit