Re: NPF: broken checksums

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 03/04/2018 à 13:07, Robert Elz a écrit :
>      Date:        Tue, 3 Apr 2018 07:48:19 +0200
>      From:        Maxime Villard <max%m00nbsd.net@localhost>
>      Message-ID:  <11cba205-ba75-757a-689a-db9897d9835d%m00nbsd.net@localhost>
>
>    |  However, if the packet
>    | contains another TCPOPT_MAXSEG option,
>
> I assume you mean here in the same TCP header, rather than in some
> included packet (ie: a tunnel or similar).

Yes, that's what I mean.

> In that case, I think what happens to the packet is whatever we please,
> and forcing the second (and any later) MSS options to be the same as
> the first is entirely reasonable.   As would be just about anything else,
> including simply sending RST.

It's not correct; when we call npf_fetch_tcpopts to only read the TCP options,
we shouldn't modify the packet. Otherwise the TCP checksum becomes invalid
(we're not recomputing it), and the AH signature too (if any).

In the end the kernel kicks the packet - which shouldn't have happened if we
only wanted to read its options.