From owner-freebsd-pf@FreeBSD.ORG  Wed Apr  5 13:06:52 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 847D416A423;
	Wed,  5 Apr 2006 13:06:52 +0000 (UTC)
	(envelope-from dhartmei@insomnia.benzedrine.cx)
Received: from insomnia.benzedrine.cx (insomnia.benzedrine.cx [62.65.145.30])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B189E43D70;
	Wed,  5 Apr 2006 13:06:48 +0000 (GMT)
	(envelope-from dhartmei@insomnia.benzedrine.cx)
Received: from insomnia.benzedrine.cx (dhartmei@localhost [127.0.0.1])
	by insomnia.benzedrine.cx (8.13.4/8.13.4) with ESMTP id k35D6kdr002400
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO);
	Wed, 5 Apr 2006 15:06:46 +0200 (MEST)
Received: (from dhartmei@localhost)
	by insomnia.benzedrine.cx (8.13.4/8.12.10/Submit) id k35D6kl4002137;
	Wed, 5 Apr 2006 15:06:46 +0200 (MEST)
Date: Wed, 5 Apr 2006 15:06:45 +0200
From: Daniel Hartmeier <daniel@benzedrine.cx>
To: Max Laier <max@love2party.net>
Message-ID: <20060405130645.GB5683@insomnia.benzedrine.cx>
References: <20060402054532.GF17711@egr.msu.edu>
	<20060404145704.GW2684@insomnia.benzedrine.cx>
	<20060404153443.GX2684@insomnia.benzedrine.cx>
	<200604051441.16865.max@love2party.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200604051441.16865.max@love2party.net>
User-Agent: Mutt/1.5.10i
Cc: Andrew Thompson <thompsa@freebsd.org>, freebsd-pf@freebsd.org
Subject: Re: broken ip checksum after frag reassemble of nfs READDIR?
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Apr 2006 13:06:52 -0000

On Wed, Apr 05, 2006 at 02:41:09PM +0200, Max Laier wrote:

> The other big problem that just crossed my mind:  Reassembly in the bridge 
> path!?  It doesn't look like the current bridge code on either OS is ready to 
> deal with packets > MTU coming out of the filter.  The question here is 
> probably how much IP processing we want to do in the bridge code?

OpenBSD's bridge does, see bridge_fragment(). IIRC, we slightly adjusted
ip_fragment() so it could be called from there, and not too much code
had to be duplicated.

        if ((len - ETHER_HDR_LEN) > dst_if->if_mtu)
                bridge_fragment(sc, dst_if, &eh, m);
        else {
		...
                bridge_ifenqueue(sc, dst_if, m);
		...
        }

  bridge_fragment()

        error = ip_fragment(m, ifp, ifp->if_mtu);
        if (error) {
                m = NULL;
                goto dropit;
        }
        
        for (; m; m = m0) {
                m0 = m->m_nextpkt;
                m->m_nextpkt = NULL;
		...
		error = bridge_ifenqueue(sc, ifp, m);
		...
	}

That's one more layer violation in bridge, but stateful filtering
basically requires fragment reassembly, at least in general.

Daniel