Hello,
I encountered a issue loading a pf.conf file
The syntax is correct but the loading crashed the system.
It happened in production via a network connection.
The issue is reproducible and I join a simplified pf.conf that still causes the
crash.
The system is now offline, I can play with it for several days in case
you're interested to debug the issue, by giving me directives or patches.
I'm not skilled enough to fix it myself in the source code.
No problem if you're not interested to debug it, may be it's
already fixed in current release. May be the rule itself is silly
but it shouldn't cause a crash.
Thanks in advance.
The kernel is the default one from a 5.2 install on i386
# uname -mrsv
OpenBSD 5.2 GENERIC#278 i386
The output from the console via serial port is:
root:~ 1# uvm_fault(0xd0a36200, 0xa64a000, 0, 1) -> e
kernel: page fault trap, code=0
Stopped at pf_test_rule+0x82a: movl 0(%edx),%eax
ddb>
I'm not sure what I can safely do with this ddb> prompt.
It looks like the crash comes from the "quick" of the load balance rule
pass in quick log on $int_if1 from $lan_if1 route-to ...
Here is the complete pf.conf that causes the crash:
cat /etc/pf.conf_both_up_bad
# $OpenBSD: pf.conf_both_up,v 1.2 2012/11/29 15:47:27 root Exp $
ext_if1="em3"
ext_if2="em2"
ext_gw1="192.168.103.1"
ext_gw2="192.168.102.1"
int_if1="em0"
lan_if1="192.168.100.0/24"
set skip on { lo em1 }
pass log
# Masquerading
pass out quick log on $ext_if1 proto { tcp udp icmp } from $lan_if1 to any
nat-to ($ext_if1) modulate state (if-bound)
pass out quick log on $ext_if2 proto { tcp udp icmp } from $lan_if1 to any
nat-to ($ext_if2) modulate state (if-bound)
# load balance outgoing traffic from internal network.
pass in quick log on $int_if1 from $lan_if1 route-to { ($ext_if1 $ext_gw1),
($ext_if2 $ext_gw2) } round-robin sticky-address
# route packets from any IPs on $ext_if1 to $ext_gw1 and the same for $ext_if2
and $ext_gw2
pass out log quick on $ext_if1 from $ext_if2 route-to ($ext_if2 $ext_gw2)
pass out log quick on $ext_if2 from $ext_if1 route-to ($ext_if1 $ext_gw1)
pass out quick log
# end
--
Au revoir, 09 51 84 42 42
Gilles Lamiral. France, Baulon (35580) 06 20 79 76 06
