NPF: broken checksums

[Maxime Villard <max%m00nbsd.net@localhost>]

I'm having trouble understanding what's going on here:

188 	if (npf_fetch_tcpopts(npc, &maxmss, &wscale) &&
189 	    nbuf_cksum_barrier(npc->npc_nbuf, mi->mi_di)) {
190 		th = npc->npc_l4.tcp;
191 		cksum = npf_fixup16_cksum(th->th_sum, mss, maxmss);
192 		th->th_sum = cksum;
193 	}

Isn't there an inverted logic? We would like to manually fix up when there is
no offloading, that is to say when !nbuf_cksum_barrier.

In fact, if you look at nbuf_cksum_barrier, you can see that it always returns
false for an inbound packet, and therefore we never update the checksum, so it
is always wrong.

As a result of that a "max-mss" procedure on "pass in" just doesn't work,
because the packets systematically get kicked in tcp_input (the checksum
validation fails).