kern/47849: ip6flow_fastforward() desn't clear csum_flags

[msaitoh%execsw.org@localhost]

>Number:         47849
>Category:       kern
>Synopsis:       ip6flow_fastforward() desn't clear csum_flags
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu May 23 16:45:00 +0000 2013
>Originator:     SAITOH Masanobu
>Release:        NetBSD 6.x and 5.x
>Organization:
>Environment:
Architecture: all
Machine: all
>Description:
        ip6flow_fastforward() doesn't clear csum_flags in a mbuf.
        ipflow_fastforward() does it. If an outgoing interface doesn't
        support hwcsum, the checksum will be corrupted. If an outgoing
        interface supprot hwcsum and not enabled, packet may be corrupt.

                               wm1       wm0
                                         with UDP6CSUM_Rx
        [machineA]--------------[machineB]-----------------[machineC]
                              NetBSD-current

        wm0: UDP6CSUM_Rx is set
        wm1: enabled = 0

        On machineC: tracetoute6 machineA

        > 1  machineB  2.023 ms  1.991 ms  1.598 ms
        > 2  machineA  2.052 ms *  1.551 ms   (<=== 2nd try failed)

        tcpdump's output on machineA:

% tcpdump -vvX -s0 -i lan0 host 2001:240:694:1:230:48ff:fed8:c268
tcpdump: listening on lan0, link-type EN10MB (Ethernet), capture size 65535 
bytes
01:32:58.306827 2001:240:694:1:230:48ff:fed8:c268.65494 > 
2001:240:694::1.33438: [udp sum ok] UDP, length: 12 [hlim 1] (len 20)
        0x0000:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0010:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0020:  0000 0000 0000 0001 ffd6 829e 0014 49f7  ..............I.
        0x0030:  0402 0000 519e 44ba 0004 3ade            ....Q.D...:.
01:32:58.306979 2001:240:694::1 > 2001:240:694:1:230:48ff:fed8:c268: [icmp6 sum 
ok] icmp6: 2001:240:694::1 udp port 33438 unreachable (len 68, hlim 64)
        0x0000:  6000 0000 0044 3a40 2001 0240 0694 0000  `....D:@...@....
        0x0010:  0000 0000 0000 0001 2001 0240 0694 0001  ...........@....
        0x0020:  0230 48ff fed8 c268 0104 2f70 0000 0000  .0H....h../p....
        0x0030:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0040:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0050:  0000 0000 0000 0001 ffd6 829e 0014 49f7  ..............I.
        0x0060:  0402 0000 519e 44ba 0004 3ade            ....Q.D...:.
01:32:58.310089 65494 > 33439: UDP, length: 12 [class 0xf0] [flowlabel 0xf0000] 
[hlim 1] (len 20)
        0x0000:  8f0f 0000 0014 1101 2001 0240 0694 0001  ...........@....

        XXXXXXXXXXXXXXXXXXXXX IPv8 ?


        0x0010:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0020:  0000 0000 0000 0001 ffd6 829f 0014 3d9a  ..............=.
        0x0030:  0502 0000 519e 44ba 0004 463a            ....Q.D...F:
01:33:13.304245 2001:240:694:1:230:48ff:fed8:c268.65494 > 
2001:240:694::1.33440: [udp sum ok] UDP, length: 12 [hlim 1] (len 20)
        0x0000:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0010:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0020:  0000 0000 0000 0001 ffd6 82a0 0014 52d2  ..............R.
        0x0030:  0602 0000 519e 44c9 0004 2ff2            ....Q.D.../.
01:33:13.304405 2001:240:694::1 > 2001:240:694:1:230:48ff:fed8:c268: [icmp6 sum 
ok] icmp6: 2001:240:694::1 udp port 33440 unreachable (len 68, hlim 64)
        0x0000:  6000 0000 0044 3a40 2001 0240 0694 0000  `....D:@...@....
        0x0010:  0000 0000 0000 0001 2001 0240 0694 0001  ...........@....
        0x0020:  0230 48ff fed8 c268 0104 2f70 0000 0000  .0H....h../p....
        0x0030:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0040:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0050:  0000 0000 0000 0001 ffd6 82a0 0014 52d2  ..............R.
        0x0060:  0602 0000 519e 44c9 0004 2ff2            ....Q.D.../.
^C


>How-To-Repeat:
        see abobe
>Fix:
        Patch:

Index: ip6_flow.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/ip6_flow.c,v
retrieving revision 1.20
diff -u -r1.20 ip6_flow.c
--- ip6_flow.c  11 Oct 2012 20:05:50 -0000      1.20
+++ ip6_flow.c  23 May 2013 12:46:23 -0000
@@ -288,6 +288,11 @@
                return 0;
        }
 
+       /*
+        * Clear any in-bound checksum flags for this packet.
+        */
+       m->m_pkthdr.csum_flags = 0;
+
        if (ip6->ip6_hlim <= IPV6_HLIMDEC)
                return 0;