amd64/112722: IP v4 udp fragmented packet reject

[Kent Fox]

>Number:         112722
>Category:       amd64
>Synopsis:       IP v4 udp fragmented packet reject
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-amd64
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed May 16 20:40:03 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Kent Fox
>Release:        FreeBSD 6.2-RELEASE
>Organization:
Intermountain Healthcare
>Environment:
6.2-RELEASE FreeBSD 6.2-RELEASE #0: Fri Jan 12 08:43:30 UTC 2007     root at portnoy.cse.buffalo.edu:/usr/obj/usr/src/sys/SMP  amd64
>Description:
When an UDP IP fragment is received on one interface and is exiting out another interface (both interfaces have a mtu = 1500), a ICMP type 3 code 1 (destination unreachable) is sent to the sending host. All other UDP packets that are not fragmented and all TCP packets are passed without issue.

bge0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        options=1b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING>
        inet x.x.44.10 netmask 0xffffff00 broadcast x.x.44.255
        ether 00:09:3d:11:99:a7
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active
bge1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        options=1b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING>
        inet x.x.244.1 netmask 0xffffff00 broadcast x.x.244.255
        ether 00:09:3d:11:99:a8
        media: Ethernet autoselect (1000baseTX <full-duplex>)
        status: active

>How-To-Repeat:
FreeBSD host with 2 interfaces used as a forwarding gateway. Create a IPSec tunnel that passes thru routers that have to fragment the packets then pass thru the FreeBSD gateway. Send a large amount of traffic (we try rdp and/or sync M$exchange). Monitor the ingress interface.
>Fix:
Not known.
>Release-Note:
>Audit-Trail:
>Unformatted: