From owner-freebsd-pf@FreeBSD.ORG  Thu Jun 11 17:50:32 2015
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 684A18A4
 for <freebsd-pf@FreeBSD.org>; Thu, 11 Jun 2015 17:50:32 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from kenobi.freebsd.org (kenobi.freebsd.org
 [IPv6:2001:1900:2254:206a::16:76])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 52C841484
 for <freebsd-pf@FreeBSD.org>; Thu, 11 Jun 2015 17:50:32 +0000 (UTC)
 (envelope-from bugzilla-noreply@freebsd.org)
Received: from bugs.freebsd.org ([127.0.1.118])
 by kenobi.freebsd.org (8.14.9/8.14.9) with ESMTP id t5BHoWZa043666
 for <freebsd-pf@FreeBSD.org>; Thu, 11 Jun 2015 17:50:32 GMT
 (envelope-from bugzilla-noreply@freebsd.org)
From: bugzilla-noreply@freebsd.org
To: freebsd-pf@FreeBSD.org
Subject: [Bug 200330] panic: pf_addr_cmp: unknown address family 0 when scrub
 fragment drop-ovl is used
Date: Thu, 11 Jun 2015 17:50:32 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: Base System
X-Bugzilla-Component: kern
X-Bugzilla-Version: 11.0-CURRENT
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: Affects Only Me
X-Bugzilla-Who: kristof@freebsd.org
X-Bugzilla-Status: New
X-Bugzilla-Priority: ---
X-Bugzilla-Assigned-To: kristof@freebsd.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-200330-17777-ZVb2oJ6QiZ@https.bugs.freebsd.org/bugzilla/>
In-Reply-To: <bug-200330-17777@https.bugs.freebsd.org/bugzilla/>
References: <bug-200330-17777@https.bugs.freebsd.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Jun 2015 17:50:32 -0000

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=200330

--- Comment #15 from Kristof Provost <kristof@freebsd.org> ---
The problem I have with 'drop-ovl' (and the same applies to 'crop') is that
it's a bit misleading.
They don't actually reassemble the fragmented packet. 

That means a far lower system load, but you can't actually filter in-depth. For
example, with 'scrub all fragment reassemble' you can do 'pass in inet proto
icmp all icmp-type echoreq keep state', but with 'scrub all fragment drop-ovl'
you'll end up just dropping a fragmented ICMP echo request. An unfragmented
ICMP echo request will just get through.
That goes against what I'd expect.

I think you (and really all pf users) want to be using 'scrub in all fragment
reassemble'.

(That said, if you can break it, please keep using drop-ovl, so I can debug it
;))

-- 
You are receiving this mail because:
You are on the CC list for the bug.