The call to in_proto_cksum_out() is only needed before the packet

is passed to ifp->if_output().  The fragment code has its own
checksum calculation and the other paths end in goto bad.
OK claudio@

diff --git a/sys/net/pf.c b/sys/net/pf.c
index e98bda1..8ea53be 100644 (file)
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: pf.c,v 1.1176 2023/05/07 16:23:23 bluhm Exp $ */
+/*     $OpenBSD: pf.c,v 1.1177 2023/05/08 13:22:13 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -6548,8 +6548,6 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
                ip = mtod(m0, struct ip *);
        }
 
-       in_proto_cksum_out(m0, ifp);
-
        if (ntohs(ip->ip_len) <= ifp->if_mtu) {
                ip->ip_sum = 0;
                if (ifp->if_capabilities & IFCAP_CSUM_IPv4)
@@ -6558,6 +6556,7 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
                        ipstat_inc(ips_outswcsum);
                        ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
                }
+               in_proto_cksum_out(m0, ifp);
                ifp->if_output(ifp, m0, sintosa(dst), rt);
                goto done;
        }
@@ -6677,8 +6676,6 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st)
                }
        }
 
-       in6_proto_cksum_out(m0, ifp);
-
        /*
         * If packet has been reassembled by PF earlier, we have to
         * use pf_refragment6() here to turn it back to fragments.
@@ -6689,6 +6686,7 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st)
        }
 
        if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
+               in6_proto_cksum_out(m0, ifp);
                ifp->if_output(ifp, m0, sin6tosa(dst), rt);
                goto done;
        }

diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index c44ad8a..7674656 100644 (file)
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ip_output.c,v 1.383 2023/05/07 16:23:23 bluhm Exp $   */
+/*     $OpenBSD: ip_output.c,v 1.384 2023/05/08 13:22:13 bluhm Exp $   */
 /*     $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $  */
 
 /*
@@ -443,7 +443,6 @@ sendit:
                goto reroute;
        }
 #endif
-       in_proto_cksum_out(m, ifp);
 
 #ifdef IPSEC
        if (ipsec_in_use && (flags & IP_FORWARDING) && (ipforwarding == 2) &&
@@ -464,7 +463,7 @@ sendit:
                        ipstat_inc(ips_outswcsum);
                        ip->ip_sum = in_cksum(m, hlen);
                }
-
+               in_proto_cksum_out(m, ifp);
                error = ifp->if_output(ifp, m, sintosa(dst), ro->ro_rt);
                goto done;
        }

diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 6fe0f1c..dfa2a3c 100644 (file)
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ip6_output.c,v 1.273 2023/05/07 16:23:24 bluhm Exp $  */
+/*     $OpenBSD: ip6_output.c,v 1.274 2023/05/08 13:22:13 bluhm Exp $  */
 /*     $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $    */
 
 /*
@@ -664,8 +664,6 @@ reroute:
                        ip6->ip6_dst.s6_addr16[1] = dst_scope;
        }
 
-       in6_proto_cksum_out(m, ifp);
-
        /*
         * Send the packet to the outgoing interface.
         * If necessary, do IPv6 fragmentation before sending.
@@ -701,6 +699,7 @@ reroute:
         * transmit packet without fragmentation
         */
        if (dontfrag || (tlen <= mtu)) {        /* case 1-a and 2-a */
+               in6_proto_cksum_out(m, ifp);
                error = ifp->if_output(ifp, m, sin6tosa(dst), ro->ro_rt);
                goto done;
        }