Date: Sun, 23 Sep 2018 09:43:30 -0400 From: "John W. O'Brien" <john@saltant.com> To: FreeBSD Net <freebsd-net@freebsd.org> Subject: IPv6 fragment reassembly regression following FreeBSD-SA-18:10.ip Message-ID: <38a2d322-eae9-ec3d-284c-af29aed10c03@saltant.com>
next in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --jObUZ66Y4pdkH6Dqi2fT6FquSGhNeagKV Content-Type: multipart/mixed; boundary="kD8OwKAsqkz8wcMa5rY4fI3UIdZkrdSh3"; protected-headers="v1" From: "John W. O'Brien" <john@saltant.com> To: FreeBSD Net <freebsd-net@freebsd.org> Message-ID: <38a2d322-eae9-ec3d-284c-af29aed10c03@saltant.com> Subject: IPv6 fragment reassembly regression following FreeBSD-SA-18:10.ip --kD8OwKAsqkz8wcMa5rY4fI3UIdZkrdSh3 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable I'd like to check my understanding and then ask a procedural question. FreeBSD-SA-18:10.ip [0], released on 08/14, was resolved by r337828 [1]. That changeset, resulting in 11.1R-p13 and 11.2R-p2, included a patch to the way IPv6 fragment reassembly is handled [2] that was part of the merge to releng. In an ensuing thread [3] two weeks later, an implementation defect was identified, but not before that defect had shipped. The defect is now being tracked as a bug [4], as of 09/03 has been fixed in head and stable/11, and is registered as a blocker for 12.0= =2E I believe this defect is the cause of a problem I detected recently where postfix would query BIND on ::1 for the DNSSEC-signed AAAA of an MX, and never receive a response. I'm a little puzzled that lo0 is affected in spite of having a 16k MTU, but the other signs are there: the symptoms appeared after upgrading from 11.2R-p1 to -p3, and I can perform that query successfully on UDPv4 or TCPv6. What I have been unable so far to determine is, will another 11.2R patch be forthcoming to resolve this regression, and if so, when? I can limp along without UDPv6 for a little while, but not until 11.3. The only clear alternative is to downgrade to -p1. [0] https://www.freebsd.org/security/advisories/FreeBSD-SA-18:10.ip.asc [1] https://svnweb.freebsd.org/changeset/base/337828 [2] https://svnweb.freebsd.org/changeset/base/337776 [3] https://lists.freebsd.org/pipermail/svn-src-head/2018-August/117514.h= tml [4] https://bugs.freebsd.org/231045 --=20 John W. O'Brien OpenPGP keys: 0x33C4D64B895DBF3B --kD8OwKAsqkz8wcMa5rY4fI3UIdZkrdSh3-- --jObUZ66Y4pdkH6Dqi2fT6FquSGhNeagKV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEKpEHkkRoSDiIJkQOWPtK56pP/m4FAlunmIcACgkQWPtK56pP /m5qTwf+Or0r4U10CBrHMyam7UFww/eJ+bc70oDGAPKAwFw5d3LahIi5i0RQdFYf OI5JC/RAdVm36pbMMwRF7RwnDBc20S6gCnSVm3EXinwI/m8LKfiC504RnawwL7Fr 3Eqj4C2dZruFNn/pNkW0CLDPGmVJbEab6LilkSf19yA7Cui1Tr6eePKEFXrYim6k pES8IruHRJdM2nMnx6wy9baYHlhmV7u0iabp8XUwC7ghQeConukVUw5LpKB5asel E/00XcxuzNCtKE138ouP2tMXgt+yqglMQkbGMAVLiYkO11NLScagAIqqFXe4vxIm hNwPa1cTtdKb+gdBKbGVWp4qTwiFwA== =LGdU -----END PGP SIGNATURE----- --jObUZ66Y4pdkH6Dqi2fT6FquSGhNeagKV--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?38a2d322-eae9-ec3d-284c-af29aed10c03>