Re: checksum offload problem freebsd

Darren Reed <[email protected]> Wed, 18 Jan 2012 03:16:57 +0100
Newsgroups	gmane.comp.security.firewalls.ipfilter
Message-ID	<30949_1326853092_4F162BE3_30949_16349_1_4F162B99.6040901@reed.wattle.id.au>
This is a multi-part message in MIME format.
--------------020008000802050707040209
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On 18/01/2012 1:15 AM, Andrew White wrote:
> Hi,
>
> Another colleague has pointed out
>
>     if_fxp in FreeBSD 7/8 adds hardware checksum support for the 82559, but not on the pseudo header. This triggers a bug in ipfilter (where it incorrectly calculates the pseudo header checksum by itself), so the patch from the PR should actually work.
>
>     The reason why it worked in 6.4 is because 6.4 didn't support hardware checksumming on 82559 at all. 
>
>
> With the patch applied from the PR, it now works as expected (freebsd 8.2 with ipfilter 1.4.34)
>
> Can this patch be added to ipfilter upstream please ?

I'll get it sorted in the next day or so.

Darren


--------------020008000802050707040209
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
    <title></title>
  </head>
  <body bgcolor="#ffffff" text="#000000">
    On 18/01/2012 1:15 AM, Andrew White wrote:
    <blockquote
cite="mid:30949_1326846506_4F16122A_30949_14246_1_CAOZMOUFF8GDtjLkBHdQjwSi3zL5_ZD7fFMM==uy2GRZ=sx0pUw@mail.gmail.com"
      type="cite">Hi,
      <div><br>
      </div>
      <div>Another&nbsp;colleague&nbsp;has pointed out
        <div><br>
        </div>
        <blockquote style="margin: 0pt 0pt 0pt 40px; border: medium
          none; padding: 0px;">
          <div><span style="">if_fxp in FreeBSD 7/8 adds hardware
              checksum support for the 82559, but not on the pseudo
              header. This triggers a bug in ipfilter (where it
              incorrectly calculates the pseudo header checksum by
              itself), so the patch from the PR should actually work.</span></div>
          <div><br style="">
          </div>
          <div><span style="">The reason why it worked in 6.4 is because
              6.4 didn't support hardware checksumming on 82559 at all.</span>&nbsp;</div>
        </blockquote>
        <div><br>
        </div>
        <div>With the patch applied from the PR, it now works as
          expected (freebsd 8.2 with ipfilter 1.4.34)</div>
        <div><br>
        </div>
        <div>Can this patch be added to ipfilter upstream please ?</div>
      </div>
    </blockquote>
    <br>
    I'll get it sorted in the next day or so.<br>
    <br>
    Darren<br>
    <br>
  </body>
</html>

--------------020008000802050707040209--