ARP request are not sent through Bridge Firewall with the BCE network dirver. I was trying to set up a PF bridge fireall when I discover the problem. I set-up 2 pc and make sure that they could ping each other. Then I set-up the bridge firewall using the 2 onboard network card of my HP Proliant DL360 G6. The onboard card uses the BCE network driver. I connected the 2 PC to the firewall as follow: PC-A ...... BCE0 (Bridge Firewall) BCE1 ...... PC-B I started to ping from PC-A to PC-B snooping the network everywhere. On PC-A, the tcpdump was showing ARP request being sent to the BCE0 interface of the firewall. On the Bridge Firewall, using tcpdump, I could see the ARP request arriving to the BCE0 interface. Again on the firewall, using tcpdump, I could see the ARP request leaving the BCE1 interface.... it seem good !!! At PC-B, using tcpdump, NO arp request were arriving. The tcpdump done on the BCE1 interface of the firewall is indicating that it is sending the ARP, but it does not do it. The BCE driver must be causing the problem. Also note that this test was done on the stock Production Release: 7.2 witch no patch and PF disable. I finally added a 4 ports Intel network card to the server and move the bridge to EM0 and EM1 and everything worked the first time I tried it. No arp problem. Conclusion ... the BCE driver is broken. Fix: Did not look at the code ... How-To-Repeat: Follow instruction above.
Responsible Changed From-To: freebsd-bugs->freebsd-net Over to maintainer(s).
Responsible Changed From-To: freebsd-net->yongari Over to expert.
State Changed From-To: open->feedback Is it still issue on 8.1-RELEASE or 7.3-RELEASE? If it's yes, could you disable TX checksum offloading on bce(4)?
On Fri, Sep 24, 2010 at 05:07:44PM -0400, Jean Aumont wrote: > Hi, > > I do not have any more the hardware to be able to test this issue. > We bought a 4 port card that used the em driver to solve this issue. > The bce drivers was the cause of the issue on BSD 7.2 > There were several bce(4) changes since 7.2-RELEASE so it might be fixed long time ago. But I'm not sure these MFCs really fixed the issue. What makes me wonder is there is no mechanism that disables ARP sending so I thought bce(4) might generate corrupted IP header checksum. Because you no longer have access to the hardware, do you agree on closing this PR? > Jean Aumont > Work: 450-677-8797x5303 > Mobile: 514-913-7275 > > -----Original Message----- > From: yongari@FreeBSD.org [mailto:yongari@FreeBSD.org] > Sent: Friday, September 24, 2010 4:59 PM > To: Jean Aumont; yongari@FreeBSD.org; yongari@FreeBSD.org > Subject: Re: kern/140051: [bce] [arp] ARP not sent through Bridge > Firewall with BCE network dirver > > Synopsis: [bce] [arp] ARP not sent through Bridge Firewall with BCE > network dirver > > State-Changed-From-To: open->feedback > State-Changed-By: yongari > State-Changed-When: Fri Sep 24 20:58:26 UTC 2010 > State-Changed-Why: > Is it still issue on 8.1-RELEASE or 7.3-RELEASE? > If it's yes, could you disable TX checksum offloading on bce(4)? > > http://www.freebsd.org/cgi/query-pr.cgi?pr=140051
State Changed From-To: feedback->open Feedback received. Submitter has no more access to the hardware.
State Changed From-To: open->closed Can't reproduce this with bce(4) on bridge(4). Probably submitter's firefall rule may have caused the issue.