Date: Sun, 2 Apr 2006 00:45:32 -0500 From: Adam McDougall <mcdouga9@egr.msu.edu> To: pf@freebsd.org Subject: broken ip checksum after frag reassemble of nfs READDIR? Message-ID: <20060402054532.GF17711@egr.msu.edu>
next in thread | raw e-mail | index | archive | help
I have been using 'ls' on a directory to test my ruleset and effects of scrubbing rules. My latest discovery is if I use 'scrub .... fragment reassemble', the packet on the outgoing interface will have a wildly incorrect IP checksum (ethereal says 0x7b49 should be 0x688d for example). I am using pf over a bridge with two 'em' interfaces, and encountered other code paths in the recent past in pf_norm.c that did not recalculate the checksum for changes it made, but in essence I think this time pf is generating this packet as a reassembly of 5 fragments (total size 6296) and doesn't seem to be applying a correct ip header checksum. The header checksum is not even similar to the checksum of the last fragment when entering the firewall (0xbfa4). Right now, I increased the outgoing em1 interface to mtu 8000 just so the outgoing nic will not get wedged in OACTIVE with 100% reproducability (more on that later). Can someone take a look and help me out, or let me know how I can help? Thanks.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060402054532.GF17711>