pfsync must let to progress state for destination peer
authorsashan <sashan@openbsd.org>
Fri, 24 May 2024 06:38:41 +0000 (06:38 +0000)
committersashan <sashan@openbsd.org>
Fri, 24 May 2024 06:38:41 +0000 (06:38 +0000)
commit6064c65c33524491775c95e480b7a907bfccb6cc
treea51ce63a6d6a986e25a53e6225e33258e156fa77
parentc7101648ccc694093c4a805ebde0f53056d1a24c
pfsync must let to progress state for destination peer

The issue has been noticed by matthieu@ when he was chasing
cause of excessive pfsync traffic between firewall boxes.
When comparing content of state tables between primary
and backup firewall the backup firewall showed many
states as follows:
ESTABLISHED:SYN_SENT
FIN_WAIT_2:SYN_SENT
*         :SYN_SENT
this is caused by pfsync_upd_tcp() which fails to update
TCP-state for destination connection peer, so it remains
stuck in SYN_SENT.

matthieu@ confirms diff helps with 'stuck-state'. It also
seems to help with excessive pfsync traffic.

ok @dlg
sys/net/if_pfsync.c