Revisiting: ipfilter/ipnat problems on -current

[Paul Goyette <paul%whooppee.com@localhost>]

Some of you may remember many months ago when I started having some 
strange problems with ipfilter/ipnat, right after a new version was 
imported.  Among other odd behavior, I was having difficulty mounting 
NFS file systems.

After several attempts to find a problem, I worked around it by using 
NFS TCP mounts, rather than the default of UDP.  All seemed to be well 
and I sort of forgot about it.

Well, a few days ago I updated my systems to -current, and something 
very odd happened.  :)

The update was done using 'build.sh install=/' and RELDIR was on one of 
my NFS mounted filesystems.  Most everything seems to work, except 
/usr/X11R6/bin/xrdb fails with a "built-in" error from the Xserver.

Trying to narrow this down a bit, I decided to verify the integrity of 
the NFS file systems.  I logged in to the NFS server and ran cksum on 
all of the X install sets, and then I ran the same cksum command on the 
system-with-the-problem.  Interestingly, I got different results for one 
of the files.  So I unmounted and remounted the file system and reran 
cksum, and got wrong results for a different file.  Repeat the umount, 
mount, cksum steps again, and got still different results!

Since these NFS problems only happen on the single client which also 
runs ipfilter/ipnat, and turning ipfilter/ipnat off avoids the problem, 
I'm pretty sure I don't have a problem on the NFS server, nor on the 
network that connects everything together.

One additional datapoint that might be relevant:  ALL of my systems, 
including all the NFS clients and the NFS server, run an IPv4 network 
only - no INET6 configured.  I'm going to try enabling INET6 on the 
machine-that-has-the-problem to see if that makes any difference.

If anyone else has any clues on how to go about resolving this, I'd 
really appreciate it.  The obvious solution might be "turn off 
ipfilter/ipnat" but I need ipnat - I don't have enough fixed IP 
addresses for everything - and I'm not willing to go out and buy a 
stand-alone device.  :)

----------------------------------------------------------------------
|   Paul Goyette   | PGP DSS Key fingerprint: |  E-mail addresses:   |
| Customer Service | FA29 0E3B 35AF E8AE 6651 |  paul%whooppee.com@localhost   |
| Network Engineer | 0786 F758 55DE 53BA 7731 | pgoyette%juniper.net@localhost |
----------------------------------------------------------------------