From 003cfddf8c84c7aee6f78fb82bad74a498420de7 Mon Sep 17 00:00:00 2001 From: bluhm Date: Mon, 8 May 2023 13:22:13 +0000 Subject: [PATCH] The call to in_proto_cksum_out() is only needed before the packet is passed to ifp->if_output(). The fragment code has its own checksum calculation and the other paths end in goto bad. OK claudio@ --- sys/net/pf.c | 8 +++----- sys/netinet/ip_output.c | 5 ++--- sys/netinet6/ip6_output.c | 5 ++--- 3 files changed, 7 insertions(+), 11 deletions(-) diff --git a/sys/net/pf.c b/sys/net/pf.c index e98bda16551..8ea53be3c2d 100644 --- a/sys/net/pf.c +++ b/sys/net/pf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf.c,v 1.1176 2023/05/07 16:23:23 bluhm Exp $ */ +/* $OpenBSD: pf.c,v 1.1177 2023/05/08 13:22:13 bluhm Exp $ */ /* * Copyright (c) 2001 Daniel Hartmeier @@ -6548,8 +6548,6 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st) ip = mtod(m0, struct ip *); } - in_proto_cksum_out(m0, ifp); - if (ntohs(ip->ip_len) <= ifp->if_mtu) { ip->ip_sum = 0; if (ifp->if_capabilities & IFCAP_CSUM_IPv4) @@ -6558,6 +6556,7 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st) ipstat_inc(ips_outswcsum); ip->ip_sum = in_cksum(m0, ip->ip_hl << 2); } + in_proto_cksum_out(m0, ifp); ifp->if_output(ifp, m0, sintosa(dst), rt); goto done; } @@ -6677,8 +6676,6 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st) } } - in6_proto_cksum_out(m0, ifp); - /* * If packet has been reassembled by PF earlier, we have to * use pf_refragment6() here to turn it back to fragments. @@ -6689,6 +6686,7 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st) } if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) { + in6_proto_cksum_out(m0, ifp); ifp->if_output(ifp, m0, sin6tosa(dst), rt); goto done; } diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index c44ad8a136d..76746568ff6 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.383 2023/05/07 16:23:23 bluhm Exp $ */ +/* $OpenBSD: ip_output.c,v 1.384 2023/05/08 13:22:13 bluhm Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -443,7 +443,6 @@ sendit: goto reroute; } #endif - in_proto_cksum_out(m, ifp); #ifdef IPSEC if (ipsec_in_use && (flags & IP_FORWARDING) && (ipforwarding == 2) && @@ -464,7 +463,7 @@ sendit: ipstat_inc(ips_outswcsum); ip->ip_sum = in_cksum(m, hlen); } - + in_proto_cksum_out(m, ifp); error = ifp->if_output(ifp, m, sintosa(dst), ro->ro_rt); goto done; } diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 6fe0f1c5aa1..dfa2a3c5245 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip6_output.c,v 1.273 2023/05/07 16:23:24 bluhm Exp $ */ +/* $OpenBSD: ip6_output.c,v 1.274 2023/05/08 13:22:13 bluhm Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -664,8 +664,6 @@ reroute: ip6->ip6_dst.s6_addr16[1] = dst_scope; } - in6_proto_cksum_out(m, ifp); - /* * Send the packet to the outgoing interface. * If necessary, do IPv6 fragmentation before sending. @@ -701,6 +699,7 @@ reroute: * transmit packet without fragmentation */ if (dontfrag || (tlen <= mtu)) { /* case 1-a and 2-a */ + in6_proto_cksum_out(m, ifp); error = ifp->if_output(ifp, m, sin6tosa(dst), ro->ro_rt); goto done; } -- 2.20.1