UDP NFS + ipf on netbsd-5 RC3 issues

[Paul Ripke <stix%stix.id.au@localhost>]

Just upgraded my main server box from netbsd-4 to netbsd-5 branch.
All my client machines (running netbsd-5.99.9) now hang doing nfs
writes.

tcpdumping port 2049 on the server, I see:

15:46:51.825065 IP (tos 0x0, ttl 64, id 490, offset 0, flags [none], proto UDP 
(17), length 132) 192.168.254.5.58407206 > 192.168.254.1.2049: 104 read [|nfs]
15:46:51.825203 IP (tos 0x0, ttl 64, id 2182, offset 0, flags [+], proto UDP 
(17), length 1500) 192.168.254.1.2049 > 192.168.254.5.58407206: reply ok 1472 
read REG 600 ids 20008/100 [|nfs]
15:46:51.827062 IP (tos 0x0, ttl 64, id 491, offset 0, flags [none], proto UDP 
(17), length 132) 192.168.254.5.58407207 > 192.168.254.1.2049: 104 read [|nfs]
15:46:51.827187 IP (tos 0x0, ttl 64, id 2183, offset 0, flags [+], proto UDP 
(17), length 1500) 192.168.254.1.2049 > 192.168.254.5.58407207: reply ok 1472 
read REG 600 ids 20008/100 [|nfs]
15:46:51.835047 IP (tos 0x0, ttl 64, id 492, offset 0, flags [none], proto UDP 
(17), length 132) 192.168.254.5.58407208 > 192.168.254.1.2049: 104 read [|nfs]
15:46:51.835166 IP (tos 0x0, ttl 64, id 2184, offset 0, flags [+], proto UDP 
(17), length 1500) 192.168.254.1.2049 > 192.168.254.5.58407208: reply ok 1472 
read REG 600 ids 20008/100 [|nfs]
15:46:51.841038 IP (tos 0x0, ttl 64, id 493, offset 0, flags [+], proto UDP 
(17), length 1500) 192.168.254.5.58407209 > 192.168.254.1.2049: 1472 write 
[|nfs]
15:46:51.843054 IP (tos 0x0, ttl 64, id 494, offset 0, flags [+], proto UDP 
(17), length 1500) 192.168.254.5.58407210 > 192.168.254.1.2049: 1472 write 
[|nfs]
15:46:51.847033 IP (tos 0x0, ttl 64, id 495, offset 0, flags [+], proto UDP 
(17), length 1500) 192.168.254.5.58407211 > 192.168.254.1.2049: 1472 write 
[|nfs]

On a hunch, I switched a client to use TCP - this worked fine. I'd
remove '-u' from nfsd options, but that seems to break nfsrooted
systems.

Further testing, and "ipf -D" fixes UDP NFS. I only had

pass in quick on sk0 all
pass out quick on sk0 all

for that interface. Now, I don't have any rules for that interface at
all, and still if "ipf -E", UDP NFS is bust. My config has been
largely unchanged since netbsd-2.0 days. I also don't see anything
logged to ipmon for these packets, even though most of my rules log.

Has anyone else seen this? Any other ideas?

-- 
Paul Ripke
I love deadlines. I like the whooshing sound they make as they fly by.
-- Douglas Adams