diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2021-04-28 10:56:06 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2021-05-07 08:17:50 +0000 |
| commit | af1b05bb32b5440dd999853bd7c01a5b8c0d73f4 (patch) | |
| tree | b96d6e94811e690c918ec497f340254c8f5e3045 | |
| parent | dc202b6e0fb5848a1b38fe490b89ee5e2d2fbded (diff) | |
pf: Fix IP checksum on reassembly
If we reassemble a packet we modify the IP header (to set the length and
remove the fragment offset information), but we failed to update the
checksum. On certain setups (mostly where we did not re-fragment again
afterwards) this could lead to us sending out packets with incorrect
checksums.
PR: 255432
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D30026
(cherry picked from commit 055c55abefbe19fe46a56894595af9c9dad7678c)
| -rw-r--r-- | sys/netpfil/pf/pf_norm.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c index 2a3c1d442fd4..8f970b68373b 100644 --- a/sys/netpfil/pf/pf_norm.c +++ b/sys/netpfil/pf/pf_norm.c @@ -790,7 +790,11 @@ pf_reassemble(struct mbuf **m0, struct ip *ip, int dir, u_short *reason) } ip = mtod(m, struct ip *); + ip->ip_sum = pf_cksum_fixup(ip->ip_sum, ip->ip_len, + htons(hdrlen + total), 0); ip->ip_len = htons(hdrlen + total); + ip->ip_sum = pf_cksum_fixup(ip->ip_sum, ip->ip_off, + ip->ip_off & ~(IP_MF|IP_OFFMASK), 0); ip->ip_off &= ~(IP_MF|IP_OFFMASK); if (hdrlen + total > IP_MAXPACKET) { |