[Bug 296944] sys/netpfil/common/rdr:ipfnat_local_redirect test failing in CI

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296944

--- Comment #12 from Cy Schubert <cy@FreeBSD.org> ---
I'm seeing something different. I have three machines in play here. The client,
called schuberc (10.1.1.196). The firewall, called bob (10.1.1.7 and 10.1.2.7).
And the server, named cwsys (10.1.2.1). The server is listening to port 1234.
The ipnat rule is,

rdr '*' from any to 10.1.1.7/32 port = 1234 -> 10.1.2.1 port 1234

tcpdump on the firewall (10.1.1.7 & 10.1.2.7) sees this:

tcpdump: listening on re0, link-type EN10MB (Ethernet), snapshot length 262144
bytes
12:55:41.002965 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6),
length 60, bad cksum 0 (->23f6)!)
    10.1.1.196.17278 > 10.1.2.1.1234: Flags [S], cksum 0x8aec (correct), seq
2254354195, win 65535, options [mss 1460,nop,wscale 8,sackOK,TS val 3864148279
ecr 0], length 0
12:55:41.003058 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 60)
    10.1.2.1.1234 > 10.1.1.196.17278: Flags [S.], cksum 0x22c1 (correct), seq
1149507515, ack 2254354196, win 65535, options [mss 1460,nop,wscale 9,sackOK,TS
val 3811453099 ecr 3864148279], length 0
12:55:41.006747 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6),
length 52, bad cksum 0 (->23fe)!)
    10.1.1.196.17278 > 10.1.2.1.1234: Flags [.], cksum 0x5080 (correct), ack 1,
win 257, options [nop,nop,TS val 3864148293 ecr 3811453099], length 0

The server (10.1.2.1) sees this:

tcpdump: listening on nfe0, link-type EN10MB (Ethernet), snapshot length 262144
bytes
12:55:40.985035 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6),
length 60)
    10.1.1.196.17278 > 10.1.2.1.1234: Flags [S], cksum 0x8aec (correct), seq
2254354195, win 65535, options [mss 1460,nop,wscale 8,sackOK,TS val 3864148279
ecr 0], length 0
12:55:40.985070 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 60, bad cksum 0 (->22f6)!)
    10.1.2.1.1234 > 10.1.1.196.17278: Flags [S.], cksum 0x17f5 (incorrect ->
0x22c1), seq 1149507515, ack 2254354196, win 65535, options [mss
1460,nop,wscale 9,sackOK,TS val 3811453099 ecr 3864148279], length 0
12:55:40.988809 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6),
length 52)
    10.1.1.196.17278 > 10.1.2.1.1234: Flags [.], cksum 0x5080 (correct), ack 1,
win 257, options [nop,nop,TS val 3864148293 ecr 3811453099], length 0

Am I correct in reading that the checksum sent (at 12:55:40.985070) by the
server (10.1.2.1) is incorrect, because it is captured by the server during
egress and not by the firewall?

-- 
You are receiving this mail because:
You are on the CC list for the bug.