broken ip checksum after frag reassemble of nfs READDIR?
mcdouga9 at egr.msu.edu
Sun Apr 2 05:45:34 UTC 2006
I have been using 'ls' on a directory to test my ruleset and effects
of scrubbing rules. My latest discovery is if I use 'scrub .... fragment
reassemble', the packet on the outgoing interface will have a wildly
incorrect IP checksum (ethereal says 0x7b49 should be 0x688d for example).
I am using pf over a bridge with two 'em' interfaces, and encountered
other code paths in the recent past in pf_norm.c that did not recalculate
the checksum for changes it made, but in essence I think this time pf is
generating this packet as a reassembly of 5 fragments (total size 6296)
and doesn't seem to be applying a correct ip header checksum. The
header checksum is not even similar to the checksum of the last fragment
when entering the firewall (0xbfa4). Right now, I increased the outgoing
em1 interface to mtu 8000 just so the outgoing nic will not get wedged in
OACTIVE with 100% reproducability (more on that later).
Can someone take a look and help me out, or let me know how I can help?
More information about the freebsd-pf