[Bug 292760] [bridge] MTU of bridge inteface limits MTU of bridge-based vlans in despite of vlanmtu flag

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=292760

--- Comment #11 from Andrew Philips <[email protected]> ---
Found an easy reproducible test case for this bug.

Version: FreeBSD 15.0-RELEASE-p2, amd64
Setup: vnet jails on tagged VLANs using a VLAN-aware bridge with epair

Inside vnet jail on a tagged VLAN:

    ping -s 1468 -c 3 8.8.8.8    # 1496-byte IP -> success
    ping -s 1472 -c 3 8.8.8.8    # 1500-byte IP -> 100% loss

The 4-byte boundary matches the VLAN tag size.

In the field: TLS handshakes to endpoints that advertise MSS 1460 (e.g., AWS)
hang silently. The TCP SYN/SYN-ACK completes (small packets), pf state shows
ESTABLISHED, but server response data at 1500-byte IP packets is dropped.
Endpoints with conservative MSS (e.g., Google at 1412) work fine, making the
failure intermittent and difficult to diagnose.

Workaround: pf MSS clamping on the VLAN interface:

    scrub on <vlan_if> all max-mss 1436

This limits TCP segments below the effective 1496-byte threshold. ICMP at 1500
bytes still fails (acceptable).

Note: Lowering the epair MTU to 1496 as an alternative workaround triggers a
separate bug found where epair_transmit() returns E2BIG for normal TCP traffic
(bug TBD).

-- 
You are receiving this mail because:
You are the assignee for the bug.