broken ip checksum after frag reassemble of nfs READDIR?

Adam McDougall mcdouga9 at
Sun Apr 2 05:45:34 UTC 2006

I have been using 'ls' on a directory to test my ruleset and effects
of scrubbing rules.  My latest discovery is if I use 'scrub .... fragment
reassemble',  the packet on the outgoing interface will have a wildly
incorrect IP checksum (ethereal says 0x7b49 should be 0x688d for example).

I am using pf over a bridge with two 'em' interfaces, and encountered
other code paths in the recent past in pf_norm.c that did not recalculate
the checksum for changes it made, but in essence I think this time pf is
generating this packet as a reassembly of 5 fragments (total size 6296)
and doesn't seem to be applying a correct ip header checksum.  The 
header checksum is not even similar to the checksum of the last fragment
when entering the firewall (0xbfa4).  Right now, I increased the outgoing
em1 interface to mtu 8000 just so the outgoing nic will not get wedged in
OACTIVE with 100% reproducability (more on that later).  

Can someone take a look and help me out, or let me know how I can help?

More information about the freebsd-pf mailing list