fragments processing

Kristof Provost kp at
Fri May 20 08:53:53 UTC 2016

Hi Max,

On 19 May 2016, at 19:49, Max wrote:
> The number of used frags (almost) never decreases. I don't have enough 
> experience in programming. But I guess that the problem may be in 
> "frag->fr_timeout = time_second;" in pf_fillup_fragment() (pf_norm.c). 
> It should be "frag->fr_timeout = time_uptime;". Actually, I don't now 
> the difference between those variables. So, correct me if I'm wrong.
I think you’re right. If I’m reading the code right time_second is 
unix time,
but time_uptime is the number of seconds the system has been up.

Either one should work, but we have to be consistent.
The rest of the code seems to use time_uptime, so this untested patch 
should fix your problem.

diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index a2841a2..dbc8818 100644
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -374,7 +374,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, 
struct pf_frent *frent,

                 *(struct pf_fragment_cmp *)frag = *key;
-               frag->fr_timeout = time_second;
+               frag->fr_timeout = time_uptime;
                 frag->fr_maxlen = frent->fe_len;

> P.P.S. I confirm the bug 

It’s on my list, but unfortunately it’s a very long list.


More information about the freebsd-pf mailing list