From owner-svn-src-stable@freebsd.org  Wed Nov 11 12:36:43 2015
Return-Path: <owner-svn-src-stable@freebsd.org>
Delivered-To: svn-src-stable@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id AE9EAA2B9F9;
 Wed, 11 Nov 2015 12:36:43 +0000 (UTC) (envelope-from kp@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 788F014CB;
 Wed, 11 Nov 2015 12:36:43 +0000 (UTC) (envelope-from kp@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id tABCagB9091016;
 Wed, 11 Nov 2015 12:36:42 GMT (envelope-from kp@FreeBSD.org)
Received: (from kp@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id tABCagb8091015;
 Wed, 11 Nov 2015 12:36:42 GMT (envelope-from kp@FreeBSD.org)
Message-Id: <201511111236.tABCagb8091015@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: kp set sender to kp@FreeBSD.org
 using -f
From: Kristof Provost <kp@FreeBSD.org>
Date: Wed, 11 Nov 2015 12:36:42 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject: svn commit: r290669 - stable/10/sys/netpfil/pf
X-SVN-Group: stable-10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-stable@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: SVN commit messages for all the -stable branches of the src tree
 <svn-src-stable.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-stable>, 
 <mailto:svn-src-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-stable/>
List-Post: <mailto:svn-src-stable@freebsd.org>
List-Help: <mailto:svn-src-stable-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-stable>,
 <mailto:svn-src-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Nov 2015 12:36:43 -0000

Author: kp
Date: Wed Nov 11 12:36:42 2015
New Revision: 290669
URL: https://svnweb.freebsd.org/changeset/base/290669

Log:
  MFC r290161:
  
  pf: Fix IPv6 checksums with route-to.
  
  When using route-to (or reply-to) pf sends the packet directly to the output
  interface. If that interface doesn't support checksum offloading the checksum
  has to be calculated in software.
  That was already done in the IPv4 case, but not for the IPv6 case. As a result
  we'd emit packets with pseudo-header checksums (i.e. incorrect checksums).
  
  This issue was exposed by the changes in r289316 when pf stopped performing full
  checksum calculations for all packets.
  
  Submitted by:       Luoqi Chen

Modified:
  stable/10/sys/netpfil/pf/pf.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netpfil/pf/pf.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf.c	Wed Nov 11 01:32:35 2015	(r290668)
+++ stable/10/sys/netpfil/pf/pf.c	Wed Nov 11 12:36:42 2015	(r290669)
@@ -5576,6 +5576,13 @@ pf_route6(struct mbuf **m, struct pf_rul
 	if (ifp->if_flags & IFF_LOOPBACK)
 		m0->m_flags |= M_SKIP_FIREWALL;
 
+	if (m0->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
+	    ~ifp->if_hwassist) {
+		uint32_t plen = m0->m_pkthdr.len - sizeof(*ip6);
+		in6_delayed_cksum(m0, plen, sizeof(struct ip6_hdr));
+		m0->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
+	}
+
 	/*
 	 * If the packet is too large for the outgoing interface,
 	 * send back an icmp6 error.