The call to in_proto_cksum_out() is only needed before the packet

is passed to ifp->if_output().  The fragment code has its own
checksum calculation and the other paths end in goto bad.
OK claudio@

3 files changed, 7 insertions, 11 deletions

diff --git a/sys/net/pf.c b/sys/net/pf.c
index e98bda16551..8ea53be3c2d 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.1176 2023/05/07 16:23:23 bluhm Exp $ */
+/*	$OpenBSD: pf.c,v 1.1177 2023/05/08 13:22:13 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -6548,8 +6548,6 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
 		ip = mtod(m0, struct ip *);
 	}
 
-	in_proto_cksum_out(m0, ifp);
-
 	if (ntohs(ip->ip_len) <= ifp->if_mtu) {
 		ip->ip_sum = 0;
 		if (ifp->if_capabilities & IFCAP_CSUM_IPv4)
@@ -6558,6 +6556,7 @@ pf_route(struct pf_pdesc *pd, struct pf_state *st)
 			ipstat_inc(ips_outswcsum);
 			ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
 		}
+		in_proto_cksum_out(m0, ifp);
 		ifp->if_output(ifp, m0, sintosa(dst), rt);
 		goto done;
 	}
@@ -6677,8 +6676,6 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st)
 		}
 	}
 
-	in6_proto_cksum_out(m0, ifp);
-
 	/*
 	 * If packet has been reassembled by PF earlier, we have to
 	 * use pf_refragment6() here to turn it back to fragments.
@@ -6689,6 +6686,7 @@ pf_route6(struct pf_pdesc *pd, struct pf_state *st)
 	}
 
 	if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
+		in6_proto_cksum_out(m0, ifp);
 		ifp->if_output(ifp, m0, sin6tosa(dst), rt);
 		goto done;
 	}
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index c44ad8a136d..76746568ff6 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_output.c,v 1.383 2023/05/07 16:23:23 bluhm Exp $	*/
+/*	$OpenBSD: ip_output.c,v 1.384 2023/05/08 13:22:13 bluhm Exp $	*/
 /*	$NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $	*/
 
 /*
@@ -443,7 +443,6 @@ sendit:
 		goto reroute;
 	}
 #endif
-	in_proto_cksum_out(m, ifp);
 
 #ifdef IPSEC
 	if (ipsec_in_use && (flags & IP_FORWARDING) && (ipforwarding == 2) &&
@@ -464,7 +463,7 @@ sendit:
 			ipstat_inc(ips_outswcsum);
 			ip->ip_sum = in_cksum(m, hlen);
 		}
-
+		in_proto_cksum_out(m, ifp);
 		error = ifp->if_output(ifp, m, sintosa(dst), ro->ro_rt);
 		goto done;
 	}
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 6fe0f1c5aa1..dfa2a3c5245 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_output.c,v 1.273 2023/05/07 16:23:24 bluhm Exp $	*/
+/*	$OpenBSD: ip6_output.c,v 1.274 2023/05/08 13:22:13 bluhm Exp $	*/
 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
 
 /*
@@ -664,8 +664,6 @@ reroute:
 			ip6->ip6_dst.s6_addr16[1] = dst_scope;
 	}
 
-	in6_proto_cksum_out(m, ifp);
-
 	/*
 	 * Send the packet to the outgoing interface.
 	 * If necessary, do IPv6 fragmentation before sending.
@@ -701,6 +699,7 @@ reroute:
 	 * transmit packet without fragmentation
 	 */
 	if (dontfrag || (tlen <= mtu)) {	/* case 1-a and 2-a */
+		in6_proto_cksum_out(m, ifp);
 		error = ifp->if_output(ifp, m, sin6tosa(dst), ro->ro_rt);
 		goto done;
 	}