PF IPv6 fragments handling

[Kristof Provost]

On 2015-03-16 09:51:55 (-0400), Eric van Gyzen <vangyzen at FreeBSD.org> wrote:
> Here is a brainstorm that might give the best of both:  Return the
> reassembled packet from PFIL_IN, but with the original fragment chain
> stashed in metadata.  Most of the stack operates on the single,
> reassembled packet.  ip6_output() sends the original fragment chain.
> Sure, it uses more memory, but reduced CPU time might be worth it.
> 
It's an interesting idea. There are a number of advantages (like not
modifying the fragment ID or the sizes of each packet).

It won't reduce CPU usage though because we'd have to copy the packet
which is something we don't do at the moment.

In addition to that there's the concern you pointed out that we'd forget
to adapt them both, or that we'd end up checking the wrong one at any
point in the stack.

Regards,
Kristof