Bug #2636
closed
state mismatch issue on enc0 with amd64
Added by Chris Buechler almost 12 years ago.
Updated over 11 years ago.
Category:
Operating System
Affected Architecture:
amd64
Description
There's some kind of state mismatch issue on enc0 with amd64. Potentially related, tcpdump on enc0 doesn't show any ingress traffic, only egress. The SYN gets passed, the SYN ACK blocked on enc0 as a state mismatch. Doesn't impact i386.
- Status changed from New to Feedback
This should behave better on latest snapshots.
- Status changed from Feedback to New
- Status changed from New to Feedback
A fix to require correct mask was submitted on master.
By any chance you have net.inet.ipsec.filtertunnel set to something grater than 0?
on the one system of ours that was having this issue, it's better than it used to be (it used to be impossible to complete a TCP handshake), but it still drops TCP sessions like crazy. Somewhere around a month ago it got better. Currently on Feb 8 snap.
$ sysctl -a|grep filtertunnel
net.inet.ipsec.filtertunnel: 0
net.inet6.ipsec6.filtertunnel: 0
- Status changed from Feedback to New
Can you try if setting net.inet.ipsec.filtertunnel: 0 to 1 makes it work correctly?
Setting net.inet.ipsec.filtertunnel=1 definitely seems to fix it. On a tunnel where I couldn't keep a TCP session going for more than a minute or two previously, after changing only that, I've had a RDP session up for over an hour and multiple SSH sessions up, with no problem at all.
Well, it fixed one problem and broke things that used to work. Incoming IPsec traffic from other connections that were working fine previously are now getting blocked in on em0 (WAN, where the IPsec terminates) where they should be hitting the rules for in on enc0.
- Status changed from New to Feedback
After further evaluation, this appears to have been fixed sometime in the past month or two by something that wasn't tagged on this specific ticket. Putting to feedback for the time being, will close after giving it some more time.
- Status changed from Feedback to Resolved
Also available in: Atom
PDF