Date: Tue, 7 Jun 2011 21:33:30 +0000 From: "Bjoern A. Zeeb" <bzeeb-lists@lists.zabbadoz.net> To: Michael Proto <mike@jellydonut.org> Cc: freebsd-pf@freebsd.org Subject: Re: IPv6 day, PF and IPv6 fragments Message-ID: <00EBAA07-0E65-49D0-A281-FF98DF6C98BA@lists.zabbadoz.net> In-Reply-To: <BANLkTik=YyzTV7CAx9MOqapZF7o7Bzaibg@mail.gmail.com> References: <20110607195057.GA37735@in-addr.com> <BANLkTik=YyzTV7CAx9MOqapZF7o7Bzaibg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Jun 7, 2011, at 9:03 PM, Michael Proto wrote: > On Tue, Jun 7, 2011 at 3:50 PM, Gary Palmer <gpalmer@freebsd.org> = wrote: >> Hi, >>=20 >> I noticed after running test-ipv6.com at home that I was getting >>=20 >> 2011-06-07 20:35:55.588335 rule 279/0(match): block in on gif0: = 2001:4998:0:6::11 > <my IP>: frag (0|1424) 80 > 62594: . 0:1392(1392) = ack 1 win 8211 <nop,nop,timestamp 3656890291 1004528553> >> 2011-06-07 20:35:55.588521 rule 279/0(match): block in on gif0: = 2001:4998:0:6::11 > <my IP>: frag (1424|16) >>=20 >> on my FreeBSD 7.3-RELEASE firewall. "man pf.conf" says >>=20 >> Currently, only IPv4 fragments are supported and IPv6 fragments = are >> blocked unconditionally. >>=20 >> Is this correct? If so, what is the correct way of getting IPv6 = fragmented >> packets through a pf firewall, or which version of FreeBSD introduces = a PF >> version that natively handles IPv6 fragments? >>=20 >> Thanks, >>=20 >> Gary >=20 > Unless I'm mistaken, there shouldn't be any fragments for IPv6, at > least nothing traversing IPv6-capable routers. MTU path-discovery is > supposed to take care of that and any fragmentation is supposed to be > done on the sending host once path-discovery determines the correct > MTU. >=20 > http://en.wikipedia.org/wiki/IPv6_packet#Fragmentation Whatever they say and what you read. There are fragments in IPv6 as well. Indeed none fragments the packet on the path but if I am going to write 32k of data to UDP you'll see a lot of fragments no matter what. Actually this is the most common frag6 source I am seeing -- large DNS replies due to DNSsec, etc. /bz --=20 Bjoern A. Zeeb You have to have visions! Stop bit received. Insert coin for new address family.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?00EBAA07-0E65-49D0-A281-FF98DF6C98BA>