Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing
- Reply: Kristof Provost : "Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing"
- In reply to: Kristof Provost : "git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 23 Jan 2024 18:32:46 UTC
On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote: > > The branch main has been updated by kp: > > URL: https://cgit.FreeBSD.org/src/commit/?id=54c62e3e5d8cd90c5571a1d4c8c5f062d580480e > > commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e > Author: Kristof Provost <kp@FreeBSD.org> > AuthorDate: 2024-01-17 17:11:27 +0000 > Commit: Kristof Provost <kp@FreeBSD.org> > CommitDate: 2024-01-22 11:52:14 +0000 > > pf: work around icmp6 packet-too-big not being sent when binat-ing > > If we're applying NPTv6 we pass a packet with a modified source and/or > destination address to the network stack. > > If that packet then turns out to be larger than the MTU of the sending > interface the stack will attempt to generate an icmp6 packet-too-big > error, but may fail to look up the appropriate source address for that > error message. Even if it does, pf would still have to undo the binat > operation inside the icmp6 packet so the sending host can make sense of > the error. > > We can avoid both problems entirely by having pf also perform the MTU > check (taking the potential refragmentation into account), and > generating the icmp6 error directly in pf. > > See also: https://redmine.pfsense.org/issues/14290 > Sponsored by: Rubicon Communications, LLC ("Netgate") > Differential Revision: https://reviews.freebsd.org/D43499 > --- > sys/net/pfvar.h | 1 + > sys/netpfil/pf/pf.c | 12 ++++++++++++ > sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ > 3 files changed, 28 insertions(+) Does this change cause problems for others too? - ssh over IPv6 permanently disconnecting (client_loop: send disconnect: Broken pipe) - ssh connections over IPv6 hanging - git pull not working Fssh_ssh_dispatch_run_fatal: Connection to 2604:1380:4091:a001::24ca:1 port 22: Permission denied fatal: Could not read from remote repository. Thanks. -- Herbert