From owner-freebsd-pf@FreeBSD.ORG  Mon Dec  8 00:31:32 2014
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 0AD79AF1
 for <freebsd-pf@freebsd.org>; Mon,  8 Dec 2014 00:31:32 +0000 (UTC)
Received: from luigi.brtsvcs.net (luigi.brtsvcs.net [204.109.60.246])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id DA0A9A5C
 for <freebsd-pf@freebsd.org>; Mon,  8 Dec 2014 00:31:31 +0000 (UTC)
Received: from chombo.houseloki.net (unknown
 [IPv6:2601:7:2580:674:21c:c0ff:fe7f:96ee])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by luigi.brtsvcs.net (Postfix) with ESMTPSA id EEA582D4F9B;
 Mon,  8 Dec 2014 00:31:23 +0000 (UTC)
Received: from [IPv6:2601:7:2580:674:baca:3aff:fe83:bd29] (ivy.libssl.so
 [IPv6:2601:7:2580:674:baca:3aff:fe83:bd29])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by chombo.houseloki.net (Postfix) with ESMTPSA id B73DB1D66;
 Sun,  7 Dec 2014 16:31:21 -0800 (PST)
Message-ID: <5484F157.9010707@bluerosetech.com>
Date: Sun, 07 Dec 2014 16:31:19 -0800
From: Darren Pilgrim <list_freebsd@bluerosetech.com>
Reply-To: freebsd-pf@freebsd.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:24.0) Gecko/20100101 Thunderbird/24.6.0
MIME-Version: 1.0
To: Kurt Jaeger <lists@opsec.eu>, freebsd-pf@freebsd.org
Subject: Re: Get RID of the multi threading patch in FreeBSDs version of PF
References: <136621417831771@web24j.yandex.ru>
 <5483605C.4070400@bluerosetech.com> <20141207105717.GP44537@home.opsec.eu>
In-Reply-To: <20141207105717.GP44537@home.opsec.eu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Dec 2014 00:31:32 -0000

On 12/7/2014 2:57 AM, Kurt Jaeger wrote:
>> On 12/5/2014 6:09 PM, Martin Hanson wrote:
>>> Has any important bugs been fixed in PF on OpenBSD since the current
>>> port in FreeBSD that actually makes the current PF in FreeBSD
>>> "dangerous" to run with?
>>
>> FreeBSD's pf is broken for IPv6.  Its lack of fragment support means a
>> FreeBSD breaks EDNS0 and other large-packet protocols that rely on
>> fragment headers.
>
> This was fixed recently as far as I understand.
>
> Have a look at
>
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=179392
>
> and
>
> https://svnweb.freebsd.org/changeset/base/274709

I think you're confused about the issue I described.  I'm talking about 
pf not supporting fragment headers and as such dropping fragmented 
packets instead of statefully passing them.

See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=124933