CVSROOT: /cvs
Module name: src
Changes by: sas...@cvs.openbsd.org 2024/05/24 00:38:41
Modified files:
sys/net : if_pfsync.c
Log message:
pfsync must let to progress state for destination peer
The issue has been noticed by matthieu@ when he was chasing
cause of excessive pfsync traffic between firewall boxes.
When comparing content of state tables between primary
and backup firewall the backup firewall showed many
states as follows:
ESTABLISHED:SYN_SENT
FIN_WAIT_2:SYN_SENT
* :SYN_SENT
this is caused by pfsync_upd_tcp() which fails to update
TCP-state for destination connection peer, so it remains
stuck in SYN_SENT.
matthieu@ confirms diff helps with 'stuck-state'. It also
seems to help with excessive pfsync traffic.
ok @dlg
