[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
kern/48377: pf "synproxy state" hangs connections to local services
>Synopsis: pf "synproxy state" hangs connections to local services
>Arrival-Date: Wed Nov 13 13:55:00 +0000 2013
>Originator: John D. Baker
NetBSD slab.technoskunk.fur 6.1_STABLE NetBSD 6.1_STABLE (SLAB) #0: Thu Nov 7
10:41:48 CST 2013
This problem has actually been around ever since NetBSD added support
for OpenBSD's "pf" packet filter. Actually first observed on
NetBSD/sparc-4.something, but certainly affects all ports.
Consider the following rule:
pass in on $ext_if proto tcp to $ext_if port ssh synproxy state
Subsequent attempts to connect to said server host with SSH will hang
indefinitely. The output of 'pfctl -s state' on the server host shows:
local_addr:22 <- remote_addr:port PROXY:DST
If the rule is used on a network firewall and SSH connections are
redirected to a host on another network, such as with:
rdr on $ext_if proto tcp from !$ext_if to $ext_if port ssh \
-> $ssh_host port ssh
then the connection succeeds.
SSH is just a convenient example, any local service using TCP would be
Configure 'pf' with a rule allowing access to a service running on the
same host including the "synproxy state" clause.
Attempt to connect to said service. Observe indefinite hang. On the
service host, observe output of 'pfctl -s state' as it relates to the
service to which connection is attempted.
Workaround: Don't use "synproxy state". The "modulate state" clause
works, but is of questionably utility for inbound connections. Or just
use "keep state" (which should be the default).
Main Index |
Thread Index |