From owner-freebsd-pf@FreeBSD.ORG Tue Feb 11 01:30:01 2014 Return-Path: Delivered-To: freebsd-pf@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 275DE7CD for ; Tue, 11 Feb 2014 01:30:01 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 1200A109E for ; Tue, 11 Feb 2014 01:30:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id s1B1U0ee068330 for ; Tue, 11 Feb 2014 01:30:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s1B1U0nL068328; Tue, 11 Feb 2014 01:30:00 GMT (envelope-from gnats) Date: Tue, 11 Feb 2014 01:30:00 GMT Message-Id: <201402110130.s1B1U0nL068328@freefall.freebsd.org> To: freebsd-pf@FreeBSD.org Cc: From: David Thiel Subject: Re: kern/179392: [pf] [ip6] Incorrect TCP checksums in rdr return packets X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: David Thiel List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Feb 2014 01:30:01 -0000 The following reply was made to PR kern/179392; it has been noted by GNATS. From: David Thiel To: bug-followup@FreeBSD.org, paul@semiocast.com Cc: Subject: Re: kern/179392: [pf] [ip6] Incorrect TCP checksums in rdr return packets Date: Mon, 10 Feb 2014 17:23:49 -0800 I've replicated this issue as well, on 10.0-RELEASE, amd64. With jails running on a cloned lo1, outbound IPv6 works fine, but pf redirect traffic gets results in incorrect checksums and traffic being dropped. Loopback interfaces no longer seem to support the -txcsum6 or -rxcsum6 flags. Would love to have a fix for this, as it kind of breaks the "service jail" model for IPv6. Cheers, David