On some interfaces, ipfilter drops UDP packets with zero checkum.

This commit fixes that.

PR:		166372
Submitted by:	mk@neon1.net
Reviewed by:	Darren Reed <darrenr@reed.wattle.id.au>
MFC after:	1 week

diff --git a/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c b/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
index 93ea5725d0bc2dd3d9d684156d1b008e52f77913..a5d3f44aea103c184bba5dcc5f8fd7b97da6cdaa 100644 (file)
--- a/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
+++ b/sys/contrib/ipfilter/netinet/ip_fil_freebsd.c
@@ -1104,6 +1104,22 @@ ipf_checkv4sum(fin)
                return -1;
        }
        if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
+               /* Depending on the driver, UDP may have zero checksum */
+               if (fin->fin_p == IPPROTO_UDP && (fin->fin_flx &
+                   (FI_FRAG|FI_SHORT|FI_BAD)) == 0) {
+                       udphdr_t *udp = fin->fin_dp;
+                       if (udp->uh_sum == 0) {
+                               /*
+                                * we're good no matter what the hardware
+                                * checksum flags and csum_data say (handling
+                                * of csum_data for zero UDP checksum is not
+                                * consistent across all drivers)
+                                */
+                               fin->fin_cksum = 1;
+                               return 0;
+                       }
+               }
+
                if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
                        sum = m->m_pkthdr.csum_data;
                else