Project

General

Profile

Actions
Copy link

Bug #5408

closed

broken TCP checksums with IPv6 and route-to/reply-to on gif interfaces

Added by Chris Buechler over 8 years ago. Updated over 8 years ago.

Status:
Resolved
Priority:
Very High
Assignee:
Chris Buechler
Category:
Operating System
Target version:
2.3
Start date:
11/10/2015
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.3
Affected Architecture:

Description

TCP checksums on IPv6 traffic matching rules specifying route-to or reply-to end up with broken TCP checksums. Every packet from a given system has the same wrong TCP checksum. Change the IPv6 source IP and the checksum it uses changes, and still stays the same across all packets.

The issue doesn't exist in stock FreeBSD 10-STABLE.

It is at least somewhat hardware-specific. In VMware ESX, vmxnet3 doesn't exhibit the issue, but e1000 does. All physical hardware seems to be affected (RCC-VE, APU, and more).

Example on 172.27.44.174. 'ping6 google.com' works, 'fetch -6 http://google.com' fails. Take out the route-to from the rule:

pass out  route-to ( ... ) inet6 from ... keep state allow-opts label "let out anything from firewall host itself"

and it works.

Actions
Copy link

Also available in: Atom PDF