From owner-freebsd-stable@FreeBSD.ORG Thu May 31 11:45:32 2007 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 3B84816A468 for ; Thu, 31 May 2007 11:45:32 +0000 (UTC) (envelope-from netslists@gmail.com) Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.239]) by mx1.freebsd.org (Postfix) with ESMTP id DCFAA13C48C for ; Thu, 31 May 2007 11:45:31 +0000 (UTC) (envelope-from netslists@gmail.com) Received: by wr-out-0506.google.com with SMTP id 70so114649wra for ; Thu, 31 May 2007 04:45:31 -0700 (PDT) DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding; b=AbaVDlkiMyogyvg/MWYOsbSstlifm9v7EOWsbQSlOgdd56BtOVrJWB1HTXAEXrRNj0IQo5VO+t9bMYhyJrQCuH+hwK/R8BfkIznZRWsnCBtfOjkS9DtCPZqB1fhxNfEqZAsMxdxZILKEQjOZsRtFXJVu3UXREhzbXUl87vke6uU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding; b=i01J4tl0U0cXYct2oIKKe36ATew7dxu4LQtxnRF01kHIk3Iunti5EFcNsCQBJMK82epcMAcLNMda37aXsPmpscdLVgAkExSN/K4MJh5S+0JNry0lPIzN3I0MDRHlV8XYYUBTk/YvztbP9BemzWeUel4GmeEtxChR+7uJc1uPw6o= Received: by 10.82.187.16 with SMTP id k16mr15978361buf.1180611930324; Thu, 31 May 2007 04:45:30 -0700 (PDT) Received: from ?192.168.16.16? ( [91.135.49.192]) by mx.google.com with ESMTP id b33sm511789ika.2007.05.31.04.45.18; Thu, 31 May 2007 04:45:26 -0700 (PDT) Message-ID: <465EB538.4040901@gmail.com> Date: Thu, 31 May 2007 13:44:56 +0200 From: Sten Daniel Soersdal User-Agent: Thunderbird 2.0.0.0 (Windows/20070326) MIME-Version: 1.0 To: Hugo Koji Kobayashi References: <20070517215025.GC37175@registro.br> In-Reply-To: <20070517215025.GC37175@registro.br> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-net@freebsd.org, freebsd-stable@freebsd.org Subject: Re: udp fragmentation with pf/ipf X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 May 2007 11:45:32 -0000 Hugo Koji Kobayashi wrote: > Hello, > > While making some tests with fragmented udp DNS responses (with > EDNS0), we discovered a possible problem with ipf and pf in FreeBSD > 6.2 and 7.0 (200705 snapshot). > > Our test is a DNS query to an DNSSEC enabled server which replies with > a ~4KB udp response. We do this with the following dig command: > > dig @192.36.144.107 se dnskey +dnssec +bufsize=4500 +retry=0 > > ipf and pf in FreeBSD 6.2 or 7.0 block the fragments and the DNS > queries timeout. Disabling the firewall, complete replies are received > with no problem. > > We've made the same tests with FreeBSD 4.11 with ipf and OpenBSD 4.1 > with pf with no problems. You can see a summary of the tests below. > > OS + fw dig result > fbsd4.11 + ipf OK > obsd4.1 + pf OK > fbsd6.2 OK > fbsd6.2 + ipf timeout > fbsd6.2 + pf timeout > fbsd7.0 OK > fbsd7.0 + ipf timeout > fbsd7.0 + pf timeout > > Complete test results (including tcpdump output and firewall rule > sets) are attached. > > Can somebody tell us if he hit a bug or if there is something we are > missing? > By the looks of it, you hit a bug. "scrub in all fragment reassemble" should reassemble good fragments before evaluating the rules. -- Sten Daniel Soersdal