pf(4) using inapropriate timeout values, 6.2-R

[Daniel Hartmeier]

On Tue, Nov 20, 2007 at 10:50:41AM +0100, Jan Srzednicki wrote:

> And the state becomes:
> 
> self tcp MY_IP_HERE:12525 <- MY_IP_HERE:64829       ESTABLISHED:FIN_WAIT_2
>    [390096685 + 66608] wscale 1  [3173294128 + 66608] wscale 1
>    age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30
>    id: 47207d980002e600 creatorid: 082298e6
> self tcp MY_IP_HERE:64829 -> MY_IP_HERE:12525       FIN_WAIT_2:ESTABLISHED
>    [3173294128 + 66608] wscale 1  [390096685 + 66608] wscale 1
>    age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30
>    id: 47207d980002e5ff creatorid: 082298e6

That's fine so far, ESTABLISHED:FIN_WAIT_2 is correct in this case.

Look at your /usr/src/sys/contrib/pf/net/pf.c, in pf_test_state_tcp()
there's a section like

		/* update expire time */
		(*state)->expire = time_second;
		if (src->state >= TCPS_FIN_WAIT_2 &&
		    dst->state >= TCPS_FIN_WAIT_2)
			(*state)->timeout = PFTM_TCP_CLOSED;
		else if (src->state >= TCPS_CLOSING &&
		    dst->state >= TCPS_CLOSING)
			(*state)->timeout = PFTM_TCP_FIN_WAIT;
		else if (src->state < TCPS_ESTABLISHED ||
		    dst->state < TCPS_ESTABLISHED)
			(*state)->timeout = PFTM_TCP_OPENING;
		else if (src->state >= TCPS_CLOSING ||
		    dst->state >= TCPS_CLOSING)
			(*state)->timeout = PFTM_TCP_CLOSING;
		else
			(*state)->timeout = PFTM_TCP_ESTABLISHED;

In 6.2-release this was, according to http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/contrib/pf/net/pf.c?rev=1.34.2.4;content-type=text%2Fplain

		/* update expire time */
		(*state)->expire = time_second;
		if (src->state >= TCPS_FIN_WAIT_2 &&
		    dst->state >= TCPS_FIN_WAIT_2)
			(*state)->timeout = PFTM_TCP_CLOSED;
		else if (src->state >= TCPS_FIN_WAIT_2 ||
		    dst->state >= TCPS_FIN_WAIT_2)
			(*state)->timeout = PFTM_TCP_FIN_WAIT;
		else if (src->state < TCPS_ESTABLISHED ||
		    dst->state < TCPS_ESTABLISHED)
			(*state)->timeout = PFTM_TCP_OPENING;
		else if (src->state >= TCPS_CLOSING ||
		    dst->state >= TCPS_CLOSING)
			(*state)->timeout = PFTM_TCP_CLOSING;
		else
			(*state)->timeout = PFTM_TCP_ESTABLISHED;

Note the slight difference, which explains your observations.

It looks like this change was never backported/merged to RELENG_6.

Try the newer (first) version, it should resolve your problem.

Daniel