Date: Sat, 21 Mar 2015 15:11:32 -0700 From: list_freebsd@bluerosetech.com To: Kristof Provost <kristof@sigsegv.be> Cc: freebsd-pf@freebsd.org Subject: Re: PF IPv6 fragments handling Message-ID: <550DEC94.4040805@bluerosetech.com> In-Reply-To: <20150317011507.GC2036@vega.codepro.be> References: <20150203202519.GD2167@vega.codepro.be> <20150209232416.GB37777@vega.codepro.be> <20150314020500.GW1975@vega.codepro.be> <5506DFFB.7050302@FreeBSD.org> <20150317011507.GC2036@vega.codepro.be>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2015-03-16 18:15, Kristof Provost wrote: > On 2015-03-16 09:51:55 (-0400), Eric van Gyzen <vangyzen@FreeBSD.org> wrote: >> Here is a brainstorm that might give the best of both: Return the >> reassembled packet from PFIL_IN, but with the original fragment chain >> stashed in metadata. Most of the stack operates on the single, >> reassembled packet. ip6_output() sends the original fragment chain. >> Sure, it uses more memory, but reduced CPU time might be worth it. >> > It's an interesting idea. There are a number of advantages (like not > modifying the fragment ID or the sizes of each packet). > > It won't reduce CPU usage though because we'd have to copy the packet > which is something we don't do at the moment. Why would you need to copy the packet in order to store a list of fragment IDs and offsets? You need that information anyway for refragmentation because an IPv6 router is not supposed to fragments. I'd interpret that to mean the fragmentation pattern coming out of pf should match what went in. A later hop wouldn't be able to send back a meaningful PTB message otherwise.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?550DEC94.4040805>