kern/166372: [patch] ipfilter drops UDP packets with zero checksum on some interfaces

[Manuel Kasper]

>Number:         166372
>Category:       kern
>Synopsis:       [patch] ipfilter drops UDP packets with zero checksum on some interfaces
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 24 11:30:10 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Manuel Kasper
>Release:        8.2-RELEASE
>Organization:
>Environment:
FreeBSD builder82.m0n0.ch 8.2-RELEASE-p3 FreeBSD 8.2-RELEASE-p3 #0: Tue Sep 27 18:07:27 UTC 2011     root at i386-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  i386
>Description:
When using ipfilter with certain network interfaces (if_vr and if_bge are known to be affected), UDP packets with zero checksum are dropped (ipmon log entries show "bad"). This causes problems in applications that use such packets, such as the common Cisco VPN.

The problem is that not all drivers set csum_data to 0xffff for packets with zero UDP checksum, so the code in sys/contrib/ipfilter/netinet/ip_fil_freebsd.c should check for zero UDP checksums first.

The attached patch solves the issue.
>How-To-Repeat:

>Fix:
See attached patch.

Patch attached with submission follows:

--- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c.orig	2010-12-21 18:09:25.000000000 +0100
+++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c	2012-03-24 12:10:52.000000000 +0100
@@ -1352,6 +1352,18 @@
 	ip = fin->fin_ip;
 
 	if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
+		/* UDP may have zero checksum */
+		if (fin->fin_p == IPPROTO_UDP && (fin->fin_flx & (FI_FRAG|FI_SHORT|FI_BAD)) == 0) {
+			udphdr_t *udp = fin->fin_dp;
+			if (udp->uh_sum == 0) {
+				/* we're good no matter what the hardware checksum flags
+				   and csum_data say (handling of csum_data for zero UDP
+				   checksum is not consistent across all drivers) */
+				fin->fin_cksum = 1;
+				return;
+			}
+		}
+
 		if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
 			sum = m->m_pkthdr.csum_data;
 		else


>Release-Note:
>Audit-Trail:
>Unformatted: