PF : problem with "reassemble tcp" breaking tcp connections

PF : problem with "reassemble tcp" breaking tcp connections

Post by Sylvain La » Fri, 04 Aug 2006 00:03:21

Hi all,

We recently upgrade a firewall from OpenBSD 3.5 to 3.9 . More precisely, we
made a fresh install of 3.9 and then copied some configurations files
(namely, and pf.conf). All went flawlessly. But we discovered
that some TCP connections were broken. Two such situations :

o Usage of AFNIC's ZoneCheck (a tool by the french registry maintaining the
.fr zone) failed 9 times out of 10, complaining that the DNS servers didn't
respond to TCP connexion

o A client wasn't able to access his website anymore through their proxy (a
linux box with apache 2.0.54 proxy) without many delays and broken images.
When accessing the web directly from their WindowsXP boxes, all was fine

o Only a very small portion of the TCP trafic was affected, but it was

We found out that the incriminated TCP connections were totally broken. For
instance, when the ZoneCheck tool connected to the DNS server, many
duplicated ACK and out-of-order packets were floating around. It was like
the ZoneCheck tool didn't received our ACKs or was rejecting them. Upong
carefull inspection (and given my not-so-brilliant tcp knowledge) intial
packets were looking good and shouldn't have generated this garbage storm.

When the DNS server was placed directly on the Internet side all was fine.
The clearly was a PF problem. After playing with the filter rules to no
avail (just to be sure nothing was blocked by error), I checked the state
options, scrub and antispoof commands. The culprit was the "reassemble tcp"
option of the scrub command. Remove it, and all was back to normal. So the
perfectly working pf.conf we used for months needed this one change not to
break tcp connections.

In the pf changelog from 3.5 to 3.9, I noticed some changes associated to
the scrub command, but nothing suggesting such a behaviour. Am I the only
one seeing this, is it a "by design" thing that I don't understand, or is it
a known problem ?

Thanks in advance.

1. is it possible to inject tcp packets in an already established tcp connection?

2. is it possible to inject tcp packets in a tcp connection?


I'm wondering if I can inject packets into an already established tcp

at a specific moment,
I should be able to hold out-going packet and inject custom created
then I should be able to increment sequence numbers for all the
packets that i have hold and all subsequent outgoing packets.

I'm thinking of using libnet to inject packets.
but I'm not sure of how to make sure tcp sequence numbers are intact.

I'd prefer window platform for development.

Thanks in advance.

3. Problems with breaking a TCP/IP connection

4. Port opened with TCP continues to accept TCP Open calls after closed

5. VxWorks TCP/IP Stack and incoming TCP connections

6. TCP Reset how to block TCP connection

7. Enlarge TCP count limitation of TCP connection

8. Simulate TCP connections to verify propper TCP behaviour ?

9. TCP segment of a reassembled PDU

10. TCP Segment of a Reassembled PDU

11. "TCP segment of a reassembled PDU" Errors

12. TCP segment of a reassembled PDU

13. simple HTTP sniffer , need help with reassembling tcp packets

14. simple HTTP sniffer , need help with reassembling tcp packets - (0/1)

15. TCP/IP printer problem - TCP Mib Library