Re: ACKs create separate state

Axel Rau <[email protected]> Tue, 10 Dec 2019 11:13:44 +0100
Newsgroups	gmane.os.openbsd.pf
Message-ID	<[email protected]>

--Apple-Mail=_82DEE0A0-2BA1-4C11-B463-ACF6DFE12634
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_3ADC5D2F-FEE1-438E-BD2C-F79EC860E317"


--Apple-Mail=_3ADC5D2F-FEE1-438E-BD2C-F79EC860E317
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8



> Am 09.12.2019 um 22:07 schrieb Axel Rau <[email protected]>:
>=20
> There seems to be a separate state for ACKs:


The origin of the problem seems to be at the other side of the link
(abcd:2222:3333:4444::200,a FreeBSD 12.1 box).
Everything is dual stack. When I block IPv6, everything works.
Why does this happen with some clients with other not (all in the same =
subnets)?
This is not application specific, but the above host is always the =
server.

This points me at the OpenBSD firewall side.
There is another firewall at the other end of the VPN.

I have a flow extracted and I attach both the OpenBSD 6.6 side (gw1)
and the FreeBSD side (db3) as text files.

Clueless:
Axel


---
PGP-Key: CDE74120  =E2=98=80  computing @ chaos claudius


--Apple-Mail=_3ADC5D2F-FEE1-438E-BD2C-F79EC860E317
Content-Type: multipart/mixed;
	boundary="Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6"


--Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=us-ascii

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><br =
class=3D""><div><br class=3D""><blockquote type=3D"cite" class=3D""><div =
class=3D"">Am 09.12.2019 um 22:07 schrieb Axel Rau &lt;<a =
href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>&gt;:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><span =
style=3D"caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; =
font-size: 12px; font-style: normal; font-variant-caps: normal; =
font-weight: normal; letter-spacing: normal; text-align: start; =
text-indent: 0px; text-transform: none; white-space: normal; =
word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: =
none; float: none; display: inline !important;" class=3D"">There seems =
to be a separate state for ACKs:</span><br style=3D"caret-color: rgb(0, =
0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; =
font-variant-caps: normal; font-weight: normal; letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; =
text-decoration: none;" class=3D""></div></blockquote></div><div =
class=3D""><br class=3D""></div>The origin of the problem seems to be at =
the other side of the link<div class=3D"">(<span style=3D"font-family: =
Menlo-Regular;" class=3D"">abcd:2222:3333:4444::200,</span>a FreeBSD =
12.1 box).</div><div class=3D"">Everything is dual stack. When I block =
IPv6, everything works.<br class=3D""><div class=3D"">Why does this =
happen with some clients with other not (all in the same =
subnets)?</div><div class=3D"">This is not application specific, but the =
above host is always the server.</div><div class=3D""><br =
class=3D""></div><div class=3D"">This points me at the OpenBSD firewall =
side.</div><div class=3D"">There is another firewall at the other end of =
the VPN.</div><div class=3D""><br class=3D""></div><div class=3D"">I =
have a flow extracted and I attach both the OpenBSD 6.6 side =
(gw1)</div><div class=3D"">and the FreeBSD side (db3) as text =
files.</div><div class=3D""><br class=3D""></div><div =
class=3D"">Clueless:</div><div class=3D"">Axel</div><div =
class=3D""></div></div></body></html>=

--Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6
Content-Disposition: attachment;
	filename=gw1.32404
Content-Type: application/octet-stream;
	x-unix-mode=0644;
	name="gw1.32404"
Content-Transfer-Encoding: 7bit

09:02:41.926033 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: S [tcp sum ok] 3144001835:3144001835(0) win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 1921615380 0> [flowlabel 0xd6aca] (len 40, hlim 62)
09:02:41.926553 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62022082 1921615380> [class 0x1] [flowlabel 0x64353] (len 40, hlim 64)
09:02:42.941912 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62023097 1921615380> [class 0x2] [flowlabel 0x64353] (len 40, hlim 64)
09:02:44.931650 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: S [tcp sum ok] 3144001835:3144001835(0) win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 1921618386 0> [flowlabel 0xd6aca] (len 40, hlim 62)
09:02:44.932179 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62025088 1921618386> [class 0x1] [flowlabel 0x64353] (len 40, hlim 64)
09:02:45.947682 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62026103 1921618386> [flowlabel 0x64353] (len 40, hlim 64)
09:02:48.156565 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62028312 1921618386> [class 0x7] [flowlabel 0x64353] (len 40, hlim 64)
09:02:48.163491 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: S [tcp sum ok] 3144001835:3144001835(0) win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 1921621618 0> [flowlabel 0xd6aca] (len 40, hlim 62)
09:02:48.164015 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62028320 1921621618> [class 0x2] [flowlabel 0x64353] (len 40, hlim 64)
09:02:49.164007 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62029320 1921621618> [flowlabel 0x64353] (len 40, hlim 64)
09:02:51.369689 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62031525 1921621618> [class 0x7] [flowlabel 0x64353] (len 40, hlim 64)
09:02:51.370872 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: S [tcp sum ok] 3144001835:3144001835(0) win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 1921624825 0> [flowlabel 0xd6aca] (len 40, hlim 62)
09:02:51.371023 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62031527 1921624825> [class 0x2] [flowlabel 0x64353] (len 40, hlim 64)
09:02:52.388482 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62032544 1921624825> [class 0x5] [flowlabel 0x64353] (len 40, hlim 64)
09:02:54.602691 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62034758 1921624825> [class 0x5] [flowlabel 0x64353] (len 40, hlim 64)
09:02:58.809898 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: S [tcp sum ok] 3857072979:3857072979(0) ack 3144001836 win 65535 <mss 1440,nop,wscale 6,sackOK,timestamp 62038965 1921624825> [flowlabel 0x64353] (len 40, hlim 64)

--Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
	charset=us-ascii

<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><div><div></div></div></body></html>
--Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6
Content-Disposition: attachment;
	filename=db3.32404
Content-Type: application/octet-stream;
	x-unix-mode=0644;
	name="db3.32404"
Content-Transfer-Encoding: 7bit

09:02:41.925105 IP6 (flowlabel 0xd6aca, hlim 62, next-header TCP (6) payload length: 40) 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: Flags [S], cksum 0x9599 (correct), seq 3144001835, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 1921615380 ecr 0], length 0
09:02:41.925140 IP6 (class 0x01, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0x06da), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62022082 ecr 1921615380], length 0
09:02:42.940483 IP6 (class 0x02, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0x02e3), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62023097 ecr 1921615380], length 0
09:02:44.930730 IP6 (flowlabel 0xd6aca, hlim 62, next-header TCP (6) payload length: 40) 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: Flags [S], cksum 0x89db (correct), seq 3144001835, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 1921618386 ecr 0], length 0
09:02:44.930760 IP6 (class 0x01, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xef5d), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62025088 ecr 1921618386], length 0
09:02:45.946251 IP6 (flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xeb66), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62026103 ecr 1921618386], length 0
09:02:48.155145 IP6 (class 0x07, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xe2c5), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62028312 ecr 1921618386], length 0
09:02:48.162563 IP6 (flowlabel 0xd6aca, hlim 62, next-header TCP (6) payload length: 40) 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: Flags [S], cksum 0x7d3b (correct), seq 3144001835, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 1921621618 ecr 0], length 0
09:02:48.162594 IP6 (class 0x02, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xd61d), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62028320 ecr 1921621618], length 0
09:02:49.162606 IP6 (flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xd235), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62029320 ecr 1921621618], length 0
09:02:51.368270 IP6 (class 0x07, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xc998), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62031525 ecr 1921621618], length 0
09:02:51.369530 IP6 (flowlabel 0xd6aca, hlim 62, next-header TCP (6) payload length: 40) 1234:56:78:9a::72.32404 > abcd:2222:3333:4444::200.601: Flags [S], cksum 0x70b4 (correct), seq 3144001835, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 1921624825 ecr 0], length 0
09:02:51.369562 IP6 (class 0x02, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xbd0f), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62031527 ecr 1921624825], length 0
09:02:52.387064 IP6 (class 0x05, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xb916), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62032544 ecr 1921624825], length 0
09:02:54.601270 IP6 (class 0x05, flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xb070), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62034758 ecr 1921624825], length 0
09:02:58.808473 IP6 (flowlabel 0x64353, hlim 64, next-header TCP (6) payload length: 40) abcd:2222:3333:4444::200.601 > 1234:56:78:9a::72.32404: Flags [S.], cksum 0xd48d (incorrect -> 0xa001), seq 3857072979, ack 3144001836, win 65535, options [mss 1440,nop,wscale 6,sackOK,TS val 62038965 ecr 1921624825], length 0

--Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><div =
class=3D""><div class=3D""></div><div class=3D""><br class=3D""><div =
class=3D"">
<div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: rgb(0, 0, =
0); letter-spacing: normal; text-align: start; text-indent: 0px; =
text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><div dir=3D"auto" style=3D"caret-color: rgb(0, 0, 0); color: =
rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: =
0px; text-transform: none; white-space: normal; word-spacing: 0px; =
-webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><div style=3D"color: rgb(0, 0, 0); letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><div style=3D"color: rgb(0, 0, 0); font-family: Helvetica; =
font-style: normal; font-variant-ligatures: normal; =
font-variant-position: normal; font-variant-caps: normal; =
font-variant-numeric: normal; font-variant-alternates: normal; =
font-variant-east-asian: normal; font-weight: normal; letter-spacing: =
normal; line-height: normal; orphans: 2; text-align: -webkit-auto; =
text-indent: 0px; text-transform: none; white-space: normal; widows: 2; =
word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: =
break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" =
class=3D""><div class=3D"">---<br class=3D"">PGP-Key:&nbsp;CDE74120 =
&nbsp;=E2=98=80 &nbsp;computing @ chaos =
claudius</div></div></div></div></div></div>
</div>
<br class=3D""></div></div></body></html>=

--Apple-Mail=_E6FE80F0-41A7-41C4-BA5F-A3FF7A452AA6--

--Apple-Mail=_3ADC5D2F-FEE1-438E-BD2C-F79EC860E317--

--Apple-Mail=_82DEE0A0-2BA1-4C11-B463-ACF6DFE12634
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.2
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEl5evOTfnjZdhkBzKaPxTRM3nQSAFAl3vb9gACgkQaPxTRM3n
QSAOhg/9EtaN8Hmil8CueUTupYoNJwJ5wI8vKd0TCdrauOBC1Vxr8aD5VwnBuaHN
6cuwEjMzqudGcqtrenHIqT/dS+uost+AhteX4KHRKiUc0m8UXlm5JRp1JdVxx/ha
+r2hydQXGL5WjUPLt8dG/YVZsx8VQiwarmvMXSOaSr4cA+5RAxqHo5Me0mlPhE11
aE0IdfA5NPFhGOCfo4xJH86+PaQPfM/uUO4oxQI0EUwRRrEg8DU0EIqgii8SrrRP
LiklEuJ2c+2x8q0U3t09HPc5FcUtSZNVwic78FTBr01t7t5b2SxIynJpwKwYO3+9
RSLvNqKZDAOchc87zFv0jLdWDt+TjrejqtcMOanOhRQ0S1JJLLRDZ1eVmovUNHTs
2qjV6c7Oao3W4800E/IjaJ/mBQlUzbu9SeH1A/UT/b5Ib63Wid1+3XLm0E//7L6X
rtYt0AceYs72ulUY7I7IDJMXhUeLAA0oFYtGgGj7MttimW7HpV7Mk0HVF7vuhu/+
nhGIDWyK1GIn1DNpHGMydiRPKkfTvbxjSZbVxMaWhVNhJf3EuhP5fUJHg4vKOK3y
B3ZhB/9EyQIChraeZDWVIfW8v0rdUGeYPajsgqQQVsTphBJsoJ85dU15EnZ/hWoW
Q+RJgsIaZks29WdhGzGwkhKITfPm5oxyT2mTQXAjGBXZvEVZVbE=
=p/RE
-----END PGP SIGNATURE-----

--Apple-Mail=_82DEE0A0-2BA1-4C11-B463-ACF6DFE12634--