kern/136781: Packets appear to drop with pf scrub and if_bridge

Kristian Shaw shawkris at hotmail.com
Wed Jul 15 10:00:09 UTC 2009


>Number:         136781
>Category:       kern
>Synopsis:       Packets appear to drop with pf scrub and if_bridge
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 15 10:00:08 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Kristian Shaw
>Release:        7.2-RELEASE #0
>Organization:
>Environment:
7.2-RELEASE FreeBSD 7.2-RELEASE #0: Sat Jul 11 06:33:55 BST 2009     root at freebsd72.gb010.itgr.net:/usr/obj/usr/src/sys/TINYBSD  i386

>Description:
FreeBSD is configured as a firewall/traffic shaping bridge.

Fragmented packets are intermittantly dropped when using pf with if_bridge. If pf's scrub function is used then fragments appear to be silently dropped.

Testing with the Windows XP ping -l function to a machine on the other side of the bridge:

ping -l <1472 = works
ping -l 1473<->1497 = dropped packets
ping -l >1498 = works

Below is the loud output when ping x.x.1.4 -l 1473 is executed.

kernel: pf_normalize_ip: reass frag 17581 @ 0-1480
trafficshaper kernel: pf_normalize_ip: reass frag 17581 @ 1480-1481
trafficshaper kernel: pf_reassemble: 1481 < 1481?
trafficshaper kernel: pf_reassemble: complete: 0xc15ba700(1501)

>How-To-Repeat:
rc.conf
*******
cloned_interfaces="bridge0"
autobridge_interfaces="bridge0"
autobridge_bridge0="vr0 vr1"
ipv4_addrs_bridge0="x.x.8.11/24"
defaultrouter="x.x.8.1"
ifconfig_vr0="up"
ifconfig_vr1="up"

sysctl
******
net.link.bridge.ipfw: 0
net.link.bridge.log_stp: 0
net.link.bridge.pfil_local_phys: 1
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 0
net.link.bridge.ipfw_arp: 0
net.link.bridge.pfil_onlyip: 1

pf.conf
*******
scrub in all fragment reassemble
>Fix:
If scrub fragment reassemble is not used then packets are passed OK.
If fragment drop-ovl is used the packets are passed OK.

>Release-Note:
>Audit-Trail:
>Unformatted:


More information about the freebsd-bugs mailing list