Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing

From: Herbert J. Skuhra <herbert_at_gojira.at>
Date: Wed, 24 Jan 2024 10:06:34 UTC 
On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote:
> 
> On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote:
> > On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote:
> >>
> >> The branch main has been updated by kp:
> >>
> >> URL: https://cgit.FreeBSD.org/src/commit/?id=54c62e3e5d8cd90c5571a1d4c8c5f062d580480e
> >>
> >> commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e
> >> Author:     Kristof Provost <kp@FreeBSD.org>
> >> AuthorDate: 2024-01-17 17:11:27 +0000
> >> Commit:     Kristof Provost <kp@FreeBSD.org>
> >> CommitDate: 2024-01-22 11:52:14 +0000
> >>
> >>     pf: work around icmp6 packet-too-big not being sent when binat-ing
> >>
> >>     If we're applying NPTv6 we pass a packet with a modified source and/or
> >>     destination address to the network stack.
> >>
> >>     If that packet then turns out to be larger than the MTU of the sending
> >>     interface the stack will attempt to generate an icmp6 packet-too-big
> >>     error, but may fail to look up the appropriate source address for that
> >>     error message. Even if it does, pf would still have to undo the binat
> >>     operation inside the icmp6 packet so the sending host can make sense of
> >>     the error.
> >>
> >>     We can avoid both problems entirely by having pf also perform the MTU
> >>     check (taking the potential refragmentation into account), and
> >>     generating the icmp6 error directly in pf.
> >>
> >>     See also:       https://redmine.pfsense.org/issues/14290
> >>     Sponsored by:   Rubicon Communications, LLC ("Netgate")
> >>     Differential Revision:  https://reviews.freebsd.org/D43499
> >> ---
> >>  sys/net/pfvar.h          |  1 +
> >>  sys/netpfil/pf/pf.c      | 12 ++++++++++++
> >>  sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++
> >>  3 files changed, 28 insertions(+)
> >
> > Does this change cause problems for others too?
> >
> > - ssh over IPv6 permanently disconnecting
> > (client_loop: send disconnect: Broken pipe)
> > - ssh connections over IPv6 hanging
> > - git pull not working
> > Fssh_ssh_dispatch_run_fatal: Connection to 2604:1380:4091:a001::24ca:1 port 22: Permission denied
> > fatal: Could not read from remote repository.
> >
> Can you include your pf.conf and a packet capture demonstrating one of these issues?

So I assume this issue affects only me or this server (igb nic). 
Disabling tso6 seems to resolve the issue.

I also have an issue with rack enabled. I only works with lro disabled
or net.inet.tcp.rack.features.cmpack=0. 

I'll check pf.conf and packet capture later.

Thanks.

--
Herbert