broken ip checksum after frag reassemble of nfs READDIR?

Adam McDougall mcdouga9 at
Wed Apr 5 13:39:32 UTC 2006

On Wed, Apr 05, 2006 at 03:06:45PM +0200, Daniel Hartmeier wrote:

  On Wed, Apr 05, 2006 at 02:41:09PM +0200, Max Laier wrote:
  > The other big problem that just crossed my mind:  Reassembly in the bridge 
  > path!?  It doesn't look like the current bridge code on either OS is ready to 
  > deal with packets > MTU coming out of the filter.  The question here is 
  > probably how much IP processing we want to do in the bridge code?

This is also something I came across while evaluating pf+if_bridge on
FreeBSD.  NFS fragment reassembly was the first repeatable offender,
and then I found I could wedge the outgoing interface in OACTIVE with
a simple ping -s 8000.  I've also seen my internal interface wedge in
OACTIVE mode after several (10+?) ruleset reloads, with unapparent

  OpenBSD's bridge does, see bridge_fragment(). IIRC, we slightly adjusted
  ip_fragment() so it could be called from there, and not too much code
  had to be duplicated.
          if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
                  bridge_fragment(sc, dst_if, &eh, m);
          else {
                  bridge_ifenqueue(sc, dst_if, m);
          error = ip_fragment(m, ifp, ifp->if_mtu);
          if (error) {
                  m = NULL;
                  goto dropit;
          for (; m; m = m0) {
                  m0 = m->m_nextpkt;
                  m->m_nextpkt = NULL;
  		error = bridge_ifenqueue(sc, ifp, m);
  That's one more layer violation in bridge, but stateful filtering
  basically requires fragment reassembly, at least in general.
  freebsd-pf at mailing list
  To unsubscribe, send any mail to "freebsd-pf-unsubscribe at"

More information about the freebsd-pf mailing list