freebsd stable - Mar 2006 - pf: synproxy broken

Hello

from ealier 6.0 there is problem with synproxy in pf filter:
this one 6.1-PRERELEASE #2: Wed Mar 15 02:02:37 MSK 2006

pf.conf just with single rule
pass in quick on lo0 proto tcp from any to any port 22 flags S/SA synproxy state

result
telnet 127.0.0.1 22
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.

and it's hangs

pfctl -s rules -v
No ALTQ support in kernel
ALTQ related functions disabled
pass in quick on lo0 proto tcp from any to any port = ssh flags S/SA synproxy
state
  [ Evaluations: 966392    Packets: 0         Bytes: 0           States: 1     ]


 pfctl -s state
No ALTQ support in kernel
ALTQ related functions disabled
self tcp 127.0.0.1:22 <- 127.0.0.1:44819       PROXY:DST

without synproxy all is ok
 
There is PR 86072 about that with unclear results.


Jura

On Thursday 16 March 2006 07:39, Yuriy N. Shkandybin
wrote:
> Hello
>
> from ealier 6.0 there is problem with synproxy in pf filter:
> this one 6.1-PRERELEASE #2: Wed Mar 15 02:02:37 MSK 2006
>
> pf.conf just with single rule
> pass in quick on lo0 proto tcp from any to any port 22 flags
> S/SA synproxy state
>
> result
> telnet 127.0.0.1 22
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
>
> and it's hangs
>
> pfctl -s rules -v
> No ALTQ support in kernel
> ALTQ related functions disabled
> pass in quick on lo0 proto tcp from any to any port = ssh flags
> S/SA synproxy state [ Evaluations: 966392    Packets: 0        
> Bytes: 0           States: 1     ]
>
>
>  pfctl -s state
> No ALTQ support in kernel
> ALTQ related functions disabled
> self tcp 127.0.0.1:22 <- 127.0.0.1:44819       PROXY:DST
>
> without synproxy all is ok
>
> There is PR 86072 about that with unclear results.
>
>
> Jura
Hi.

Do you have
"set state-policy if-bound"
in your options section of /etc/pf.conf?  That's cleared up 
synproxy problems for me before.

hth,

jon b