date:20170201

[Bug 216719] panic: ipfw_check_frame: unknown retval - while trying to ipfw nat incoming packet without translation state (can be L2 firewall related)

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216719

Bug ID: 216719
   Summary: panic: ipfw_check_frame: unknown retval - while trying
to ipfw nat incoming packet without translation state
(can be L2 firewall related)
   Product: Base System
   Version: CURRENT
  Hardware: Any
OS: Any
Status: New
  Severity: Affects Only Me
  Priority: ---
 Component: kern
  Assignee: freebsd-bugs@FreeBSD.org
  Reporter: b...@kobyla.org

Panic on processing ingress ipfw nat for any spurious packet (without matching
NAT state)

ipfw tunables:
net.link.bridge.ipfw_arp: 0
net.link.bridge.ipfw: 0
net.link.ether.ipfw: 1 -- can be the problem source (not tested yet)
net.inet.ip.fw.one_pass: 0

own prefix:
# ifconfig lo194
lo194: flags=8049 metric 0 mtu 16384
options=63
inet 194.246.74.1 netmask 0x 
inet 194.246.74.77 netmask 0x 
inet 194.246.74.201 netmask 0x 
nd6 options=29
groups: lo 

uplink-1:
 rl0.3498: flags=8843 metric 0 mtu 1500
uplink-2:
 rl0.2386: flags=8843 metric 0 mtu 1500

uplink-3: mpd5 pppoe (not used in testing)
ng0: flags=88d1 metric 0 mtu
1478

# ipfw show
061010  0 nat 101 log ip from table(5) to any out xmit rl0.*
06109  931  48145 deny log ip from any to 194.246.74.201 in

09900  206  12360 deny log ip from
10.0.0.0/8,192.168.0.0/16,172.16.0.0/19 to any xmit rl0.*
09910  843 172719 deny log ip from
10.0.0.0/8,192.168.0.0/16,172.16.0.0/19 to any xmit ng0
099200  0 deny log ip from any to 194.246.74.0/24 xmit ng0

11784   16708 deny tcp from any to any dst-port
3306,3128,135,139,445 recv ng0
16675 3107 150704 deny log ip from any to any dst-port
111,135,139,445,958,3306,4443,3306,3128 recv rl0*
65530 10032698 2985048430 allow ip from any to any
65535  907  52740 allow ip from any to any


No panic until 6108 rule added (ingress nat):
# ipfw add 6108 nat 101 log logamount 0 all from any to 194.246.74.201 in recv
rl0.*

Panic after receiving any incoming packet to the nat address:

80.252.249.247> ping 194.246.74.201

<110>ipfw: 6109 Nat ICMP:8.0 80.252.249.247 194.246.74.201 in via rl0.3498



 cel.home dumped core - see /var/crash/vmcore.343

 Wed Feb  1 21:01:56 EET 2017

 FreeBSD cel.home 12.0-CURRENT FreeBSD 12.0-CURRENT #29 r312942: Sun Jan 29
22:29:43 EET 2017 r...@cel.home:/usr/obj/usr/src/sys/PDC10  amd64

 panic: ipfw_check_frame: unknown retval

 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you are
 welcome to change it and/or distribute copies of it under certain conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for details.
 This GDB was configured as "amd64-marcel-freebsd"...

 Unread portion of the kernel message buffer:
 <110>ipfw: 6109 Nat ICMP:8.0 80.252.249.247 194.246.74.201 in via rl0.3498
 panic: ipfw_check_frame: unknown retval
 cpuid = 1
 KDB: stack backtrace:
 db_trace_self_wrapper() at 0x8032264b =
db_trace_self_wrapper+0x2b/frame 0xfe3f9530
 vpanic() at 0x80547196 = vpanic+0x186/frame 0xfe3f95b0
 kassert_panic() at 0x80547006 = kassert_panic+0x126/frame
0xfe3f9620
 ipfw_check_frame() at 0x80782446 = ipfw_check_frame+0x286/frame
0xfe3f9770
 pfil_run_hooks() at 0x8064c7ac = pfil_run_hooks+0x9c/frame
0xfe3f9800
 ether_demux() at 0x806367c8 = ether_demux+0x48/frame
0xfe3f9830
 ether_nh_input() at 0x806376d9 = ether_nh_input+0x319/frame
0xfe3f9870
 netisr_dispatch_src() at 0x8064b6a0 = netisr_dispatch_src+0x80/frame
0xfe3f98d0
 ether_input() at 0x80636c32 = ether_input+0x62/frame
0xfe3f9900
 vlan_input() at 0x8063da1c = vlan_input+0x1dc/frame 0xfe3f9980
 ether_demux() at 0x80636828 = ether_demux+0xa8/frame
0xfe3f99b0
 ether_nh_input() at 0x806376d9 = ether_nh_input+0x319/frame
0xfe3f99f0
 netisr_dispatch_src() at 0x8064b6a0 = netisr_dispatch_src+0x80/frame
0xfe3f9a50
 ether_input() at 0x80636c32 = ether_input+0x62/frame
0xfe3f9a80
 rl_rxeof() at 0x8040086f = rl_rxeof+0x25f/frame 0xfe3f9ae0
 rl_intr() at 0x803ff68e = rl_intr+0xee/frame 0xfe3f9b20
 intr_event_execute_handlers() at 0x8050e5f6 =
intr_event_execute_handlers+0x96/frame 0xfe3f9b60
 ithread_loop() at 0x8050ec66 = ithread_loop+0xa6/frame

[Bug 204340] [panic] nfsd, em, msix, fatal trap 9

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=204340

Rick Macklem  changed:

   What|Removed |Added

 Status|Closed  |In Progress
 Resolution|FIXED   |---

--- Comment #24 from Rick Macklem  ---
Please test the patch I just attached. (4th one) I think it might make the
code less fragile to nfsd threads being signalled. I have not been able
to create a crash with the patch during limited testing.

Since avg@'s crash occurred with the other patches, I have reopened the
PR.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 204340] [panic] nfsd, em, msix, fatal trap 9

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=204340

--- Comment #23 from Rick Macklem  ---
Created attachment 179512
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=179512=edit
add svcpool_close so that svcpool_destroy doesn't get called when nfsd threads
are killed

This patch adds a new function to the server krpc called svcpool_close().
It is similar to svcpool_destroy(), but does not free the data structures,
so that the pool can be used again.

This function is then used instead of svcpool_destroy(), svcpool_create()
when the nfsd threads are killed.

These crashes are caused because the data structures were free'd by
svcpool_destroy() when the nfsd threads were killed off (or signalled somehow).
By avoiding the svcpool_destroy() call, the crashes should be avoided.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 216687] make buildkernel fails due to compilation error in sys/dev/nvme/nvme.h 11-STABLE r312990

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216687

Mark Linimon  changed:

   What|Removed |Added

   Assignee|freebsd-bugs@FreeBSD.org|a...@freebsd.org
   Keywords||regression

--- Comment #1 from Mark Linimon  ---
Over to committer of r312990.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 216681] IPsec traceroute6 -I does not work

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216681

Mark Linimon  changed:

   What|Removed |Added

   Assignee|freebsd-bugs@FreeBSD.org|freebsd-...@freebsd.org
   Keywords||patch

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 216681] IPsec traceroute6 -I does not work

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216681

Andrey V. Elsukov  changed:

   What|Removed |Added

 CC|freebsd-am...@freebsd.org   |h...@freebsd.org

--- Comment #3 from Andrey V. Elsukov  ---
(In reply to Jason Mader from comment #2)
> (In reply to Andrey V. Elsukov from comment #1)
> 
> Just for reference, Linux with a similar icmp6 out transport policy does add
> the AH. And FreeBSD does handle the echo response with AH.

This is not linux or freebsd kernel specificity, this is how traceroute6 works.
You can try to rebuild traceroute6 without IPSEC support, and I think it will
work like you want. 

Index: usr.sbin/traceroute6/Makefile
===
--- usr.sbin/traceroute6/Makefile   (revision 312816)
+++ usr.sbin/traceroute6/Makefile   (working copy)
@@ -22,7 +22,7 @@ SRCS= as.c traceroute6.c
 BINOWN=root
 BINMODE= 4555

-CFLAGS+= -DIPSEC -DUSE_RFC2292BIS -DHAVE_POLL
+CFLAGS+= -DUSE_RFC2292BIS -DHAVE_POLL
 CFLAGS+= -I${.CURDIR} -I${TRACEROUTE_DISTDIR} -I.

 WARNS?=3

PS. I'm not sure, but, IMHO, almost all IPSEC related code in the traceroute6
is dead and should be removed. At least we have not implemented in our kernel
all these IPV6_[ESP|AUTH]_XXX socket options, that traceroute6 tries to
configure.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 216681] IPsec traceroute6 -I does not work

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216681

--- Comment #2 from Jason Mader  ---
(In reply to Andrey V. Elsukov from comment #1)

Just for reference, Linux with a similar icmp6 out transport policy does add
the AH. And FreeBSD does handle the echo response with AH.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 216681] IPsec traceroute6 -I does not work

2017-02-01 Thread bugzilla-noreply

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=216681

Andrey V. Elsukov  changed:

   What|Removed |Added

 CC||a...@freebsd.org

--- Comment #1 from Andrey V. Elsukov  ---
This looks like traceroute6(8) installs IPSEC BYPASS security policy for the
used socket. This is why your policy did not applied.

-- 
You are receiving this mail because:
You are the assignee for the bug.
___
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"

[Bug 216719] panic: ipfw_check_frame: unknown retval - while trying to ipfw nat incoming packet without translation state (can be L2 firewall related)

[Bug 204340] [panic] nfsd, em, msix, fatal trap 9

[Bug 204340] [panic] nfsd, em, msix, fatal trap 9

[Bug 216687] make buildkernel fails due to compilation error in sys/dev/nvme/nvme.h 11-STABLE r312990

[Bug 216681] IPsec traceroute6 -I does not work

[Bug 216681] IPsec traceroute6 -I does not work

[Bug 216681] IPsec traceroute6 -I does not work

[Bug 216681] IPsec traceroute6 -I does not work

8 matches

Site Navigation

Mail list logo

Footer information