[Bug 293227] VNET jail regression on 14-STABLE from 14.3 using bridge and epair
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 19 Feb 2026 12:34:13 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293227 --- Comment #7 from Timo Voelker <timo.voelker@fh-muenster.de> --- I found the cause for this issue. When the sender in the jail sends a TCP packet, it uses checksum offloading because, since 503bf058cd0, epair offers checksum offloading. Thus, it skips computing the checksum and just sets a bit on the mbuf for the packet indicating that the TCP checksum still has to be computed. The host drops the packet and responds with an ICMPv6 Packet Too Big message if it is too large. When doing that, it reuses the mbuf of the packet that triggered the ICMPv6 message. It basically prepends an IPv6 and ICMPv6 header and leaves the checksum offloading bit set. When sending this over the bridge back to the sender, the host notices that the bridge does not support checksum offloading. Due to the checksum offloading bit, the host assumes a TCP packet and computes and inserts the TCP checksum somewhere in the ICMP packet. This changes the ICMP packet, which makes the ICMP checksum incorrect. I created a patch that resets the checksum offloading bits in this case. https://reviews.freebsd.org/D55367 -- You are receiving this mail because: You are the assignee for the bug.