freebsd 6-beta2, pf, route-to, checksum errors

From: Peter van Dijk <peter_at_dataloss.nl>
Date: Tue, 23 Aug 2005 00:39:53 +0200
Hi,

I recently upgraded my FreeBSD/sparc64 5.4 router at home to 6-BETA2,
without changing pf.conf. Since this upgrade, UDP packets redirected
with pf's route-to feature get the wrong checksum.

My complete ruleset:
root_at_onion# grep -v ^# /etc/pf.conf   
ext_if="hme0"   # replace with actual external interface name i.e., dc0
int_if="vlan2"  # replace with actual internal interface name i.e., dc1
virtix_if="vlan4"       # replace with actual internal interface name i.e., dc1
scrub in all
nat on $ext_if from $int_if:network to any -> ($ext_if)
nat on $virtix_if from $int_if:network to any -> ($virtix_if)
pass out on $ext_if route-to ( $virtix_if 195.16.85.169 ) from $virtix_if:network to any

ifconfig snippets to understand :network above:
vlan2: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 172.16.13.32 netmask 0xffffff00 broadcast 172.16.13.255
vlan4: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        inet 195.16.85.170 netmask 0xfffffff8 broadcast 195.16.85.175


tcpdump output of a broken DNS request:
onion# tcpdump -n -i vlan4 -s 0 -v port 53
tcpdump: listening on vlan4, link-type EN10MB (Ethernet), capture size 65535 bytes
00:28:37.762481 IP (tos 0x0, ttl  56, id 0, offset 0, flags [DF], proto: UDP (17), length: 68) 83.160.178.78.32812 > 195.16.85.170.53: 31240+ A? onion.home.dataloss.nl. (40)
00:28:37.765844 IP (tos 0x0, ttl  64, id 37505, offset 0, flags [none], proto: UDP (17), length: 117, bad cksum 86f (->c94d)!) 195.16.85.170.53 > 83.160.178.78.32812:  31240*- 1/1/1 onion.home.dataloss.nl. A 195.16.85.170 (89)


Note the 'bad cksum'. When I set a route to this client IP
(83.160.178.78), thereby never matching the relevant pf rule, the
packet is fine and the answer arrives:

00:29:57.498780 IP (tos 0x0, ttl  64, id 38175, offset 0, flags [none], proto: UDP (17), length: 117) 195.16.85.170.53 > 83.160.178.78.32812:  33831*- 1/1/1 onion.home.dataloss.nl. A 195.16.85.170 (89)


Am I doing something wrong, did I miss a notice in upgrading, or have
I uncovered a bug?

Thank you for your time.

Cheers, Peter
-- 
peter_at_dataloss.nl        | ~ tonight tonight, what is this potion
http://blog.dataloss.nl/ | ~ that makes a fool of me
UnderNet/#clue           |     Wayfinder, fr-025 soundtrack
Received on Mon Aug 22 2005 - 20:39:56 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:41 UTC