Bug 212384 - pfsync(4) bulk update fail
Summary: pfsync(4) bulk update fail
Status: Closed Not A Bug
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 10.3-STABLE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-pf (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-09-05 10:47 UTC by patfbsd
Modified: 2016-12-01 21:12 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description patfbsd 2016-09-05 10:47:31 UTC 
Hello,

I have a pair of firewalls with PF and pfsync(4) bulk update always fail here, but the live synchronization works fine.
As far I can see with tcpdump, pfsync does not send anything on the syncdev interface when doing a "service pfsync start" or "service pfsync restart".

Log:
kernel: carp: demoted by 0 to 0 (pfsync bulk start)
kernel: pfsync: requesting bulk update
kernel: carp: demoted by 0 to 0 (pfsync bulk fail)
kernel: pfsync: failed to receive bulk update

But when doing *twice* the command "service pfsync start", the bulk update is successful and the PF states are well transmitted from the pfsync peer.

Log:
kernel: carp: demoted by 0 to 0 (pfsync bulk start)
kernel: pfsync: requesting bulk update
kernel: pfsync: requesting bulk update
kernel: pfsync: requesting bulk update
kernel: pfsync: received bulk update start
kernel: pfsync: received bulk update start
kernel: carp: demoted by 0 to 0 (pfsync bulk done)
kernel: pfsync: received valid bulk update end

----

Uname:

FreeBSD fucop2.univ-rennes1.fr 10.3-STABLE FreeBSD 10.3-STABLE #3 r302560: Mon Jul 11 09:51:42 CEST 2016     adminsys@vmfucop.univ-rennes1.fr:/usr/obj/usr/src/sys/FUCOP  amd64

Config
------

Interface ix1 is skipped in pf.conf and I've tried without syncpeer but this does not change anything.

On firewall 1
-------------
pfsync_enable="YES"
pfsync_syncdev="ix1"
pfsync_syncpeer="192.168.255.254"
# ix1 : pfsync
ifconfig_ix1="inet 192.168.255.253/30 -tso -lro -vlanhwtso description PF_SYNC"

On firewall 2
-------------
pfsync_enable="YES"
pfsync_syncdev="ix1"
pfsync_syncpeer="192.168.255.253"
# ix1 : pfsync
ifconfig_ix1="inet 192.168.255.254/30 -tso -lro -vlanhwtso description PF_SYNC"


Thanks, regards.
Comment 1 patfbsd 2016-10-27 13:14:03 UTC 
Hello,

My firewalls are now in production and it appears that with a lot of states (~600 000 here). The pfsync bulk works fine just using /etc/rc.d/pfsync.

So there is something wrong when the number of states is low or very low.

Regards,
Comment 2 patfbsd 2016-12-01 19:13:52 UTC 
Hello,

We have tracked down this problem to a misworking fiber on the pfsync physical link.

So I think we can close this PR.

Sorry for the noise, best regards.
Comment 3 Kristof Provost freebsd_committer freebsd_triage 2016-12-01 21:12:20 UTC 
Closed as per comment #2