Kernel panic with PF

[Michal Mertl]

Max Laier píše v pá 21. 07. 2006 v 02:05 +0200:
> [CC'ing -pf]
> 
> On Thursday 20 July 2006 17:53, Michal Mertl wrote:
> > Hello,
> >
> > I am deploying FreeBSD based application proxies' based firewall
> > (www.kernun.com, but not much English there) and am having frequent
> > panics of RELENG_6_1 under load. The server has IP forwarding disabled.
> >
> > I've got two machines in a carp cluster and the transparent proxies use
> > PF to get the data.
> 
> Which proxies are you using?  The "pool_ticket: 1429 != 1430" messages you 
> quote below indicate a synchronization problem within the app talking to pf 
> via ioctl's.  Tickets are used to ensure atomic commits for operations that 
> require more than one ioctl.  If your proxy app runs in parallel it might 
> screw up the internal state and thus leave it undefined afterwards.  I give 
> you that this shouldn't cause a kernel problem, but if we could fix the app 
> we can probably find the right sanity check more easily.

The proxy in fact runs in parallel (according to "pfctl -s info" it did
about 50 inserts and removal in the state table per second - some 10Mbit
of traffic, probably mostly HTTP) and it is quite possible that your
explanation is correct. I will forward your suspicion to the vendor.
This functionality of the software (using PF with anchors) is quite new
- they used different mechanisms in previous versions so it may well
have some bugs.

Thanks

Michal