misc/112708: ipfw is seems to be broken to limit number of connections

[Vyacheslav Silakov]

>Number:         112708
>Category:       misc
>Synopsis:       ipfw is seems to be broken to limit number of connections
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 16 11:30:04 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Vyacheslav Silakov
>Release:        FreeBSD 6.2-STABLE
>Organization:
JSC Internet-Arkhangelsk
>Environment:
FreeBSD fw.inar.ru 6.2-STABLE FreeBSD 6.2-STABLE #3: Fri May 11 15:45:11 MSD 2007     seal at fw.inar.ru:/usr/obj/usr/src/sys/FW  i386

>Description:
IPFW rules:
ipfw add allow tcp from me to me 25
ipfw add allow tcp from x.x.x.0/19 to me 25 limit dst-port 100
ipfw add allow tcp from any to me 25 limit dst-port 500
works fine with FreeBSD 4.11-STABLE.

However they doesn't work properly after upgrade to 6.2-STABLE.
Our mail server is always heavy loaded. When I'm installing this ipfw rules number of sendmail connections is keeping around selected limit (500-600 sendmail processes. ps -ax| grep sendmail | wc). But after 5-10 minutes of runtime number of sendmail processes is going to 25 and server rejects new smtp connections. 'ipfw -f flush' and ipfw reconfiguration makes smtp-server alive for another 5-10 minutes and so on.

>How-To-Repeat:

>Fix:
none
>Release-Note:
>Audit-Trail:
>Unformatted: