From owner-freebsd-pf@FreeBSD.ORG  Mon May  8 15:49:31 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 598E416A405;
	Mon,  8 May 2006 15:49:31 +0000 (UTC)
	(envelope-from mcdouga9@daemon.egr.msu.edu)
Received: from daemon.egr.msu.edu (daemon.egr.msu.edu [35.9.44.65])
	by mx1.FreeBSD.org (Postfix) with ESMTP id BC08C43D5C;
	Mon,  8 May 2006 15:49:30 +0000 (GMT)
	(envelope-from mcdouga9@daemon.egr.msu.edu)
Received: by daemon.egr.msu.edu (Postfix, from userid 21281)
	id 4884D1CC30; Mon,  8 May 2006 11:49:30 -0400 (EDT)
Date: Mon, 8 May 2006 11:49:30 -0400
From: Adam McDougall <mcdouga9@egr.msu.edu>
To: Andrew Thompson <thompsa@freebsd.org>
Message-ID: <20060508154929.GS30200@egr.msu.edu>
References: <20060402054532.GF17711@egr.msu.edu>
	<20060404145704.GW2684@insomnia.benzedrine.cx>
	<20060404153443.GX2684@insomnia.benzedrine.cx>
	<200604051441.16865.max@love2party.net>
	<20060405130645.GB5683@insomnia.benzedrine.cx>
	<20060416053023.GD56603@heff.fud.org.nz>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20060416053023.GD56603@heff.fud.org.nz>
User-Agent: Mutt/1.5.11
Cc: freebsd-pf@freebsd.org
Subject: Re: broken ip checksum after frag reassemble of nfs READDIR?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 May 2006 15:49:31 -0000

On Sun, Apr 16, 2006 at 05:30:23PM +1200, Andrew Thompson wrote:

  On Wed, Apr 05, 2006 at 03:06:45PM +0200, Daniel Hartmeier wrote:
  > On Wed, Apr 05, 2006 at 02:41:09PM +0200, Max Laier wrote:
  > 
  > > The other big problem that just crossed my mind:  Reassembly in the bridge 
  > > path!?  It doesn't look like the current bridge code on either OS is ready to 
  > > deal with packets > MTU coming out of the filter.  The question here is 
  > > probably how much IP processing we want to do in the bridge code?
  > 
  > OpenBSD's bridge does, see bridge_fragment(). IIRC, we slightly adjusted
  > ip_fragment() so it could be called from there, and not too much code
  > had to be duplicated.
  > 
  
  Here is a patch that adds fragmenting, largely based on whats in
  OpenBSD. I didnt bring over bridge_send_icmp_err() as we can only get a
  large packet to fragment by reassembling a previous fragment, checking
  for DF and sending an icmp doesnt apply to us.
  
  Can I get a review, esp. the traversal of the mbufs.
  
  
  cheers,
  Andrew

I should have a chance to test this support this week, thanks for working
on it.  Could someone possibly produce a patch to force if_bridge to 
recalculate the checksum on every packet so I can test that as well?
To me, the extra load on the firewall is less important than breaking
packets I am trying to pass.