[Bug 296944] sys/netpfil/common/rdr:ipfnat_local_redirect test failing in CI

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296944

--- Comment #9 from Michael Tuexen <tuexen@freebsd.org> ---
I instrumented ipf_check_wrapper() to print various data before and after
calling ipf_check():

ipf_check_wrapper: before: flags: 20000, th_dport= 1234, csum_flags:
4<CSUM_IP_TCP>, csum_data: 10, th_sum=8497 (8497).
ipf_check_wrapper: after: flags: 20000, th_dport=1234, csum_flags:
4<CSUM_IP_TCP>, csum_data: 10, th_sum=8497 (8497).
ipf_check_wrapper: before: flags: 10000, th_dport= 1234, csum_flags:
5<CSUM_IP,CSUM_IP_TCP>, csum_data: 10, th_sum=8497 (8497).
ipf_fix_outcksum: cksum: 0, n: 35, partial: 0, 8497 -> 8474
ipf_check_wrapper: after: flags: 10000, th_dport=1234, csum_flags:
5<CSUM_IP,CSUM_IP_TCP>, csum_data: 10, th_sum=8474 (84ba).
ipf_check_wrapper: before: flags: 60000, th_dport= 1234, csum_flags:
5<CSUM_IP,CSUM_IP_TCP>, csum_data: 10, th_sum=8474 (84ba).
ipf_check_wrapper: after: flags: 60000, th_dport=1234, csum_flags:
5<CSUM_IP,CSUM_IP_TCP>, csum_data: 10, th_sum=8474 (84ba).

One can see that the TCP segment being handled has the checksum computation
deferred. Therefore the checksum field in the TCP checksum contain the pseudo
header checksum. The value in parentheses is the pseudo header computed at the
time of printing. So one can see that the checksum field is updated in
ipf_fix_outcksum(), but incorrectly.

Cy: Can you take a look?

-- 
You are receiving this mail because:
You are on the CC list for the bug.