kern/170081: pf/nat/jails not working if checksum offloading is enabled on fxp0

[Herbert J. Skuhra]

>Number:         170081
>Category:       kern
>Synopsis:       pf/nat/jails not working if checksum offloading is enabled on fxp0
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jul 23 08:40:11 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Herbert J. Skuhra
>Release:        FreeBSD 9.1-PRERELEASE amd64
>Organization:
>Environment:
FreeBSD oslo.ath.cx 9.1-PRERELEASE FreeBSD 9.1-PRERELEASE #0 r238601: Wed Jul 18 22:41:20 CEST 2012     herbert at oslo.ath.cx:/usr/obj/usr/src/sys/OSLO  amd64
>Description:
If checksum offloading is enabled on fxp0 pf/nat does not work properly.
Therefore the network in my jails does not work.

With tcpdump I see SYN packets going out and SYN+ACK packets coming in on fxp0, but connections time out (no ACKs). pflog doesn't show any blocked packets.

I can reproduce this issue on different computers with fxp.
With ipfw/natd it's working.

pf/nat and different nic (e.g: em0) are OK too.

After disabling checksum offloading (ifconfig fxp0 -rxcsum) pf is working. (Thanks to yongari@ for the hint).


>How-To-Repeat:
# ifconfig lo1 create
# ifconfig lo1 10.0.0.10 netmask 0xffffff00
# pf -e -f /root/pf.conf [1]
# nc -s 10.0.0.10 173.194.70.108 25
Connection fails.

[1] My pf.conf:
nat log on fxp0 inet from 10.0.0.0/8 to any -> fxp0
pass in all
pass out all

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: