From owner-freebsd-current@FreeBSD.ORG  Thu Jul 22 22:01:31 2004
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 7A03316A4CE
	for <freebsd-current@freebsd.org>;
	Thu, 22 Jul 2004 22:01:31 +0000 (GMT)
Received: from moutng.kundenserver.de (moutng.kundenserver.de
	[212.227.126.177])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 1F7E643D1F
	for <freebsd-current@freebsd.org>;
	Thu, 22 Jul 2004 22:01:31 +0000 (GMT)
	(envelope-from max@love2party.net)
Received: from [212.227.126.207] (helo=mrelayng.kundenserver.de)
	by moutng.kundenserver.de with esmtp (Exim 3.35 #1)
	id 1Bnld4-0000oX-00; Fri, 23 Jul 2004 00:01:30 +0200
Received: from [84.128.139.174] (helo=donor.laier.local)
	by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128)
	(Exim 3.35 #1)
	id 1Bnld4-00061F-00; Fri, 23 Jul 2004 00:01:30 +0200
From: Max Laier <max@love2party.net>
To: freebsd-current@freebsd.org
Date: Thu, 22 Jul 2004 23:59:12 +0200
User-Agent: KMail/1.6.2
References: <cdpbts$om0$1@sea.gmane.org>
In-Reply-To: <cdpbts$om0$1@sea.gmane.org>
MIME-Version: 1.0
Content-Type: multipart/signed;
  protocol="application/pgp-signature";
  micalg=pgp-sha1;
  boundary="Boundary-02=_7iDABeE2DhapSs4";
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <200407222359.23147.max@love2party.net>
X-Provags-ID: kundenserver.de abuse@kundenserver.de
	auth:61c499deaeeba3ba5be80f48ecc83056
cc: othermark <atkin901@yahoo.com>
Subject: Re: fixing out of order first fragment processing?
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 22 Jul 2004 22:01:31 -0000


--Boundary-02=_7iDABeE2DhapSs4
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Thursday 22 July 2004 23:34, othermark wrote:
> Hi,
>
> This is one of those obscure, yet well known issues in FreeBSD,
> some network stacks, like Linux, send the udp/icmp fragment
> first (if multiple frags -- in reverse order), then the orginal
> packet with the header.
>
> In -current, we still cannot process this simple fragged icmp-echo
> request from a Linux host.  For example, 'ping -c 1 -s 1500 <freebsd ip>'.
>
> FreeBSD discards the frag(s) and when it sees the initial packet with
> header waits for the frags.
>
> So two questions:
>
> 1. is there a gnats pr?  I tried various searches with no success.
> 2. are there workarounds/patches?

Activation of pf with a
	scrub in on <interface> fragment reassemble
rule works as workaround. In every case you have to decide if you want to=20
invest the required memory to store fragments, which might make you=20
easy/easier prey for DoS-attacks. Usually, for an average gateway the cost =
is=20
worth the gain (=3D increased security).

=2D-=20
/"\  Best regards,			| mlaier@freebsd.org
\ /  Max Laier				| ICQ #67774661
 X   http://pf4freebsd.love2party.net/	| mlaier@EFnet
/ \  ASCII Ribbon Campaign		| Against HTML Mail and News

--Boundary-02=_7iDABeE2DhapSs4
Content-Type: application/pgp-signature
Content-Description: signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQBBADi7XyyEoT62BG0RApMqAJ9W6S1o2XOtEKjYgXBWVzqN9hGFJwCeIMeH
Z0txgmJtlI+Bn17E7zLJG+o=
=QSmo
-----END PGP SIGNATURE-----

--Boundary-02=_7iDABeE2DhapSs4--