PF IPv6 fragments handling

Kristof Provost kristof at sigsegv.be
Tue Mar 17 01:15:12 UTC 2015


On 2015-03-16 09:51:55 (-0400), Eric van Gyzen <vangyzen at FreeBSD.org> wrote:
> Here is a brainstorm that might give the best of both:  Return the
> reassembled packet from PFIL_IN, but with the original fragment chain
> stashed in metadata.  Most of the stack operates on the single,
> reassembled packet.  ip6_output() sends the original fragment chain.
> Sure, it uses more memory, but reduced CPU time might be worth it.
> 
It's an interesting idea. There are a number of advantages (like not
modifying the fragment ID or the sizes of each packet).

It won't reduce CPU usage though because we'd have to copy the packet
which is something we don't do at the moment.

In addition to that there's the concern you pointed out that we'd forget
to adapt them both, or that we'd end up checking the wrong one at any
point in the stack.

Regards,
Kristof


More information about the freebsd-pf mailing list