From nobody Wed Apr 16 18:02:54 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Zd85C3pLbz5t28w; Wed, 16 Apr 2025 18:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Zd85C0tfLz3RHB; Wed, 16 Apr 2025 18:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744826575; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hlbT9n3jHwCg+X02LNhZiOBdZc6JWGkZSC6AKJJcmhA=; b=cmGOfIMCyyS6sDBce5vnH7lGaCO1XbNyYnVYh9DP/hHaUxa3ZlhklJ2f/XYHPXI+JgDfAD B1KFKLN61JbGsw+3rtEYKe11U7SjonEMPDYn5HJv5gdEuZlkgKlaVKSmIG637UiDXUCmx1 I8V4w8XBSA+24n0zP+yAu8MCOlNJ9NrW1Zi2SbUF0B5IbhKgelNpyIT2ZpeZAee5qNB+Xj 0noQGYzPEYRPek+x4X9+3er7C6bcqBtdvDKbM7VaV4I83Ai6wy+Sj4f81l/P94Zaed0f9h kicEYSUvpitbD5btKNeXgYx4xe4OYaWtVi/nvLSrmLTPa2ulNZOCysSvwco3sQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1744826575; a=rsa-sha256; cv=none; b=r32ybaTFoCLdCphg2ajtApy+Biycwv4fBnnlSMMaWkT0c5FnJ1b7j+8uykeIuumu2+U+I2 GJsYyCv5mhk0R4AErZxLJ2csox81o86b8SuQOkrDfOiPgjHp75x8mkacrc9jX32a7fhS+M 4pORuxAXjsneQDif+4Wvq2ldDK+GmNU1rAZD0EMMQYGI09QLSCm7Qx3INqfJ3lIMKI4B9m UpvJHm83L1+wM4oMobM2A8G5fpffXkHprgC6eOS1icuvJC0C4ylDxBrNUsLXB23y0v9Vy/ oyhncSsySE9LJjGnU7P+QFeOlCXmLZOO1QUvU5QnghhpjZO2lLuDGw6Cm7d1ow== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744826575; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hlbT9n3jHwCg+X02LNhZiOBdZc6JWGkZSC6AKJJcmhA=; b=YraYmUlVuo4oJHAFPDXobCRC5jLA1ZvVetOLwTtXDSEEdpMJ2uzfwEE1PQF/qr5u90PkhD NsxiBNRcWcfIPP8bjaMW3cFdLOO8AjOhfs7iJWO1ChmM7AkFP+lL2L9xpTk44Hheo1mwM5 qEpNihoRxCdBiT48545rnJd6F3xFwp2VMHu7OdzAa0CMyPx671+YKf1ul5dpVhj0r44WNe BYUOWquYozE3maoq3bIJ7xfAEZo1fkJu6p2GvArhpF8z78d+c+IgdBJciycBwWxbgaV69r NF5C1Qa2kSQ1DOvtfJ15Eh+Uf5X8iJTM8LDo6ze8R77a7K/URKe9y8Iedx/dbw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Zd85C01Cwz1Rpb; Wed, 16 Apr 2025 18:02:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 53GI2sdC075822; Wed, 16 Apr 2025 18:02:54 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 53GI2siK075819; Wed, 16 Apr 2025 18:02:54 GMT (envelope-from git) Date: Wed, 16 Apr 2025 18:02:54 GMT Message-Id: <202504161802.53GI2siK075819@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 3f39713e4e34 - main - pf: log reused states in addition to failed state insertions List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3f39713e4e34f1de02f81f1dcf7a40f1a81c633e Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=3f39713e4e34f1de02f81f1dcf7a40f1a81c633e commit 3f39713e4e34f1de02f81f1dcf7a40f1a81c633e Author: Kristof Provost AuthorDate: 2025-04-16 07:46:15 +0000 Commit: Kristof Provost CommitDate: 2025-04-16 14:23:48 +0000 pf: log reused states in addition to failed state insertions To assist debugging TCP connection reuse with NAT, expand the existing log in pf_state_key_attach() from the failed to the reuse case. OK mikeb@ Obtained from: OpenBSD, bluhm , 3cd642e673 Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index b6525b229c48..97d332bd348c 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -1467,9 +1467,35 @@ keyattach: si->key[PF_SK_STACK]->af && sk->af == si->key[PF_SK_STACK]->af && si->direction != s->direction))) { + bool reuse = false; + if (sk->proto == IPPROTO_TCP && si->src.state >= TCPS_FIN_WAIT_2 && - si->dst.state >= TCPS_FIN_WAIT_2) { + si->dst.state >= TCPS_FIN_WAIT_2) + reuse = true; + + if (V_pf_status.debug >= PF_DEBUG_MISC) { + printf("pf: %s key attach " + "%s on %s: ", + (idx == PF_SK_WIRE) ? + "wire" : "stack", + reuse ? "reuse" : "failed", + s->kif->pfik_name); + pf_print_state_parts(s, + (idx == PF_SK_WIRE) ? + sk : NULL, + (idx == PF_SK_STACK) ? + sk : NULL); + printf(", existing: "); + pf_print_state_parts(si, + (idx == PF_SK_WIRE) ? + sk : NULL, + (idx == PF_SK_STACK) ? + sk : NULL); + printf("\n"); + } + + if (reuse) { /* * New state matches an old >FIN_WAIT_2 * state. We can't drop key hash locks, @@ -1486,25 +1512,6 @@ keyattach: si->timeout = PFTM_PURGE; olds = si; } else { - if (V_pf_status.debug >= PF_DEBUG_MISC) { - printf("pf: %s key attach " - "failed on %s: ", - (idx == PF_SK_WIRE) ? - "wire" : "stack", - s->kif->pfik_name); - pf_print_state_parts(s, - (idx == PF_SK_WIRE) ? - sk : NULL, - (idx == PF_SK_STACK) ? - sk : NULL); - printf(", existing: "); - pf_print_state_parts(si, - (idx == PF_SK_WIRE) ? - sk : NULL, - (idx == PF_SK_STACK) ? - sk : NULL); - printf("\n"); - } s->timeout = PFTM_UNLINKED; if (idx == PF_SK_STACK) /*