I have been using 'ls' on a directory to test my ruleset and effects of scrubbing rules. My latest discovery is if I use 'scrub .... fragment reassemble', the packet on the outgoing interface will have a wildly incorrect IP checksum (ethereal says 0x7b49 should be 0x688d for example).
I am using pf over a bridge with two 'em' interfaces, and encountered other code paths in the recent past in pf_norm.c that did not recalculate the checksum for changes it made, but in essence I think this time pf is generating this packet as a reassembly of 5 fragments (total size 6296) and doesn't seem to be applying a correct ip header checksum. The header checksum is not even similar to the checksum of the last fragment when entering the firewall (0xbfa4). Right now, I increased the outgoing em1 interface to mtu 8000 just so the outgoing nic will not get wedged in OACTIVE with 100% reproducability (more on that later). Can someone take a look and help me out, or let me know how I can help? Thanks. _______________________________________________ freebsd-pf@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
