From owner-freebsd-net@FreeBSD.ORG  Mon Nov 12 15:33:19 2007
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E4B6B16A421
	for <freebsd-net@freebsd.org>; Mon, 12 Nov 2007 15:33:19 +0000 (UTC)
	(envelope-from dhartmei@insomnia.benzedrine.cx)
Received: from insomnia.benzedrine.cx (insomnia.benzedrine.cx
	[IPv6:2001:6f8:1098::2])
	by mx1.freebsd.org (Postfix) with ESMTP id 9235F13C4A5
	for <freebsd-net@freebsd.org>; Mon, 12 Nov 2007 15:33:19 +0000 (UTC)
	(envelope-from dhartmei@insomnia.benzedrine.cx)
Received: from insomnia.benzedrine.cx (localhost.benzedrine.cx [127.0.0.1])
	by insomnia.benzedrine.cx (8.14.1/8.13.4) with ESMTP id lACFXJDk029876
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO);
	Mon, 12 Nov 2007 16:33:19 +0100 (MET)
Received: (from dhartmei@localhost)
	by insomnia.benzedrine.cx (8.14.1/8.12.10/Submit) id lACFXIAE022358;
	Mon, 12 Nov 2007 16:33:18 +0100 (MET)
Date: Mon, 12 Nov 2007 16:33:18 +0100
From: Daniel Hartmeier <daniel@benzedrine.cx>
To: Max Laier <max@love2party.net>
Message-ID: <20071112153318.GE28276@insomnia.benzedrine.cx>
References: <86zlxoblmj.fsf@ds4.des.no> <200711082259.46222.max@love2party.net>
	<86fxzgl63d.fsf@ds4.des.no> <200711090059.54990.max@love2party.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200711090059.54990.max@love2party.net>
User-Agent: Mutt/1.5.12-2006-07-14
Cc: Dag-Erling Sm?rgrav <des@des.no>, freebsd-net@freebsd.org
Subject: Re: pf misfeature
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 12 Nov 2007 15:33:20 -0000

On Fri, Nov 09, 2007 at 12:59:46AM +0100, Max Laier wrote:

> Daniel, do you spot anything strange with these skip steps (or otherwise)?

The problem is the lack of IP reassembly in this configuration.

In pf_test_fragment(), a rule with r->flagset ("flags S/SA") is skipped.

Generally, stateful filtering _requires_ IP reassembly. As long as no
fragmentation occurs, it works even without reassembly. I suspect your
UDP NFS traffic is fragmented.

Try adding

  scrub in on $if all fragment reassemble

at the top.

Daniel