diff options
| author | Bob Beck <beck@cvs.openbsd.org> | 2001-06-29 18:36:18 +0000 |
|---|---|---|
| committer | Bob Beck <beck@cvs.openbsd.org> | 2001-06-29 18:36:18 +0000 |
| commit | d7162c24a6515826264df81bd471658b760a986e (patch) | |
| tree | 8ee78af77f6eb56b7fc6e4dc6fd16c43fd27b779 /sys | |
| parent | 7fe82d8289f4aea5692bfb62d76b5081fe2a6546 (diff) | |
move pf_test check to happen after checksum calculation - without
this packets originating from this host (such as with an rdr to localhost
for transparent proxying) do not get checksummed correctly, because the
pf code does not have a correct checksum to fix up (ok kjell@)
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet/ip_output.c | 27 |
1 files changed, 14 insertions, 13 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index 42a69af4bee..d089d2d71c9 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.131 2001/06/28 21:53:42 provos Exp $ */ +/* $OpenBSD: ip_output.c,v 1.132 2001/06/29 18:36:17 beck Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -638,18 +638,6 @@ sendit: } #endif /* IPSEC */ - /* - * Packet filter - */ -#if NPF > 0 - if (pf_test(PF_OUT, ifp, &m) != PF_PASS) { - error = EHOSTUNREACH; - m_freem(m); - goto done; - } - ip = mtod(m, struct ip *); - hlen = ip->ip_hl << 2; -#endif /* Catch routing changes wrt. hardware checksumming for TCP or UDP. */ if (m->m_pkthdr.csum & M_TCPV4_CSUM_OUT) { if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) || @@ -666,6 +654,19 @@ sendit: } /* + * Packet filter + */ +#if NPF > 0 + if (pf_test(PF_OUT, ifp, &m) != PF_PASS) { + error = EHOSTUNREACH; + m_freem(m); + goto done; + } + ip = mtod(m, struct ip *); + hlen = ip->ip_hl << 2; +#endif + + /* * If small enough for interface, can just send directly. */ if ((u_int16_t)ip->ip_len <= ifp->if_mtu) { |