From 73fec218b58931ed8164f0f5054811095e817f58 Mon Sep 17 00:00:00 2001 From: bz Date: Tue, 31 Jul 2012 23:34:06 +0000 Subject: In case of IPsec he have to do delayed checksum calculations before adding any extension header, or rather before calling into IPsec processing as we may send the packet and not return to IPv6 output processing here. PR: kern/170116 MFC After: 3 days --- sys/netinet6/ip6_output.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 9270d89..1fdedf1 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -306,6 +306,20 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt, goto freehdrs; case -1: /* Do IPSec */ needipsec = 1; + /* + * Do delayed checksums now, as we may send before returning. + */ + if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) { + plen = m->m_pkthdr.len - sizeof(*ip6); + in6_delayed_cksum(m, plen, sizeof(struct ip6_hdr)); + m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6; + } +#ifdef SCTP + if (m->m_pkthdr.csum_flags & CSUM_SCTP_IPV6) { + sctp_delayed_cksum(m, sizeof(struct ip6_hdr)); + m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6; + } +#endif case 0: /* No IPSec */ default: break; -- cgit v1.1