Re: PF IPv6 fragments handling (was: Re: Checksumming outgoing packets in PF vs in ip[6]_output)

2014-12-18 Thread Kristof Provost
On 2014-12-18 11:29:01 (+0100), Ilya Bakulin wrote: > On 2014-11-09 21:15, Kristof Provost wrote: > > On 2014-11-09 14:30:55 (+0100), Ilya Bakulin wrote: > >> On 07.11.14, 14:31, Kristof Provost wrote: > > You can find the patch series here: > > http://www.sigsegv.be/files/pf_inet6_frag.tar > > a

PF IPv6 fragments handling (was: Re: Checksumming outgoing packets in PF vs in ip[6]_output)

2014-12-18 Thread Ilya Bakulin
On 2014-11-09 21:15, Kristof Provost wrote: On 2014-11-09 14:30:55 (+0100), Ilya Bakulin wrote: On 07.11.14, 14:31, Kristof Provost wrote: You can find the patch series here: http://www.sigsegv.be/files/pf_inet6_frag.tar and everything in one big patch here: http://www.sigsegv.be/files/pf_inet

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-14 Thread Ermal Luçi
Hello Ilya, just approval from some people. I will follow-up. On Fri, Nov 14, 2014 at 1:34 PM, Ilya Bakulin wrote: > Hi Ermal, > yes, this patch works for both #179392 and #172648. > > What do you need to merge this into -CURRENT and MFC to stable/9? > > > On 2014-11-14 12:57, Ermal Luçi wrote:

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-14 Thread Ilya Bakulin
Hi Ermal, yes, this patch works for both #179392 and #172648. What do you need to merge this into -CURRENT and MFC to stable/9? On 2014-11-14 12:57, Ermal Luçi wrote: > Here is a direct patch. > Give it a try. > > For the reply-to issues there is another patch complementary to this i > will send

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-14 Thread Ermal Luçi
Here is a direct patch. Give it a try. For the reply-to issues there is another patch complementary to this i will send. On Fri, Nov 14, 2014 at 11:34 AM, Ilya Bakulin wrote: > Hi all, > > actually with _my_ checksumming patch the rdr-to is broken completely :-( > So I'm waiting for Ermal to se

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-14 Thread Ilya Bakulin
Hi all, actually with _my_ checksumming patch the rdr-to is broken completely :-( So I'm waiting for Ermal to send an updated version of his patch that may really solve the problem! On 2014-11-14 09:17, Ermal Luçi wrote: Yes confirmed it will solve that issue as well. On Thu, Nov 13, 2014 a

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-14 Thread Ermal Luçi
Yes confirmed it will solve that issue as well. On Thu, Nov 13, 2014 at 9:30 PM, J David wrote: > On Wed, Nov 5, 2014 at 9:28 AM, Ilya Bakulin wrote: > > Of course it was interesting what does the upstream PF do (@ OpenBSD). > Seems > > they have made the decision to > > leave the task of recal

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-13 Thread J David
On Wed, Nov 5, 2014 at 9:28 AM, Ilya Bakulin wrote: > Of course it was interesting what does the upstream PF do (@ OpenBSD). Seems > they have made the decision to > leave the task of recalculating the checksums for outgoing packets to > ip[6]_output, because currently > the code there overwrites

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-09 Thread Kristof Provost
On 2014-11-09 14:30:55 (+0100), Ilya Bakulin wrote: > On 07.11.14, 14:31, Kristof Provost wrote: > > I've been playing with it too. I have a patch which seems to be working, > > but it currently drops the distinction between PFRULE_FRAGCROP and > > PFRULE_FRAGDROP. OpenBSD dropped that a while ago

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-09 Thread Ilya Bakulin
On 07.11.14, 14:31, Kristof Provost wrote: > On 2014-11-05 19:11:55 (+0100), Ilya Bakulin wrote: >> On 2014-11-05 19:00, Mark Felder wrote: >>> Now if we could only stamp out the bug with ipv6 fragment and pf I'd be >>> a happy, happy daemon. :-) >> This is somewhat more complex problem, I'll take

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-07 Thread Kristof Provost
On 2014-11-05 19:11:55 (+0100), Ilya Bakulin wrote: > On 2014-11-05 19:00, Mark Felder wrote: > > Now if we could only stamp out the bug with ipv6 fragment and pf I'd be > > a happy, happy daemon. :-) > > This is somewhat more complex problem, I'll take a look as the time > allows. > I've been

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-05 Thread Ilya Bakulin
On 2014-11-05 19:00, Mark Felder wrote: On Wed, Nov 5, 2014, at 08:28, Ilya Bakulin wrote: Hi all, I have been hit by this 2-year-old bug with PF and 'scrub reassemble tcp' on IPv6 connections: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=172648 Wow, this is great. I've known about this

Re: Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-05 Thread Mark Felder
On Wed, Nov 5, 2014, at 08:28, Ilya Bakulin wrote: > Hi all, > > I have been hit by this 2-year-old bug with PF and 'scrub reassemble > tcp' on IPv6 connections: > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=172648 > Wow, this is great. I've known about this problem since I discovered i

Checksumming outgoing packets in PF vs in ip[6]_output

2014-11-05 Thread Ilya Bakulin
Hi all, I have been hit by this 2-year-old bug with PF and 'scrub reassemble tcp' on IPv6 connections: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=172648 I have been able to trace it down to the modifications of timestamp values by timestamp modulation code [1]. If I remove those two pf