Change Details

scrub rules have defaulted to handling fragments for a long time, but since we removed "fragment crop" and "fragment drop-ovl" in 64b3b4d611 this has become less obvious and more expensive ("reassemble" being the more expensive option, even if it's the one the vast majority of users should be using). This is somewhat unexpected, even if a 'scrub on $interface' rule did show 'scrub on $interface fragment reassemble' when retrieved. Add a PFRULE_REASSEMBLE_FRAG flag so that we can enable and disable fragment reassemble. Sponsored by: Rubicon Communications, LLC ("Netgate")

scrub rules have defaulted to handling fragments for a long time, but since we removed "fragment crop" and "fragment drop-ovl" in 64b3b4d611 this has become less obvious and more expensive ("reassemble" being the more expensive option, even if it's the one the vast majority of users should be using). Extent the 'scrub' syntax to allow fragment reassembly to be disabled, while retaining the other scrub behaviour (e.g. TTL changes, random-id, ..) using 'scrub fragment no reassemble'. Sponsored by: Rubicon Communications, LLC ("Netgate")

scrub rules have defaulted to handling fragments for a long time, but since we removed "fragment crop" and "fragment drop-ovl" in 64b3b4d611 this has become less obvious and more expensive ("reassemble" being the more expensive option, even if it's the one the vast majority of users should be using). This is somewhat unexpected, even if a 'scrub on $interface' rulExtent the 'scrub' syntax to allow fragment reassembly to be didsabled, show 'scrub on $interface fragment reassemble' when retrieved. Add a PFRULE_REASSEMBLE_FRAG flag so that we can enable and disablewhile retaining the other scrub behaviour (e.g. TTL changes, random-id, ..) using 'scrub fragment no reassemble'. Sponsored by: Rubicon Communications, LLC ("Netgate")