I have been using 'ls' on a directory to test my ruleset and effects
of scrubbing rules.  My latest discovery is if I use 'scrub .... fragment
reassemble',  the packet on the outgoing interface will have a wildly
incorrect IP checksum (ethereal says 0x7b49 should be 0x688d for example).

I am using pf over a bridge with two 'em' interfaces, and encountered
other code paths in the recent past in pf_norm.c that did not recalculate
the checksum for changes it made, but in essence I think this time pf is
generating this packet as a reassembly of 5 fragments (total size 6296)
and doesn't seem to be applying a correct ip header checksum.  The 
header checksum is not even similar to the checksum of the last fragment
when entering the firewall (0xbfa4).  Right now, I increased the outgoing
em1 interface to mtu 8000 just so the outgoing nic will not get wedged in
OACTIVE with 100% reproducability (more on that later).  

Can someone take a look and help me out, or let me know how I can help?
Thanks.
_______________________________________________
freebsd-pf@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to