netinet: fix checksum calculation bug

[timo.voelker_fh-muenster.de]

Summary

D49677 introduced the new function in_delayed_cksum_o in ip_output.c that computes the checksum even if the mbuf does not start with the IP header by using the parameter iph_offset as the offset to the IP header.

If the iph_offset is larger than 0, this function computes a wrong checksum for a TCP packet. For a TCP packet, it calls in_cksum_skip with the IP total length field value as second parameter, where in_cksum_skip expects the length of the mbuf.

[tuexen]

sys/netinet/ip_output.c

1069

Would it be better to use

	 cklen = ntohs(ip->ip_len) - (ip->ip_hl << 2);

That would keep the semantic of cklen. Then you could use

	csum = in_cksum_skip(m, cklen + offset, offset);

below.
You could then simplify the code even further to use this statement always. Only the mapping of 0 to 0xffff would be UDP specific.

[timo.voelker_fh-muenster.de]

sys/netinet/ip_output.c

1069

Using

cklen = ntohs(ip->ip_len) - (ip->ip_hl << 2);

for UDP indeed simplifies the code but changes the behavior if the value in the UDP length field is not equal to the value in the IP total length field - the IP header length. This might be the case with UDP options (RFC9868). Would that be an issue?

[tuexen]

sys/netinet/ip_output.c

1069

I don't know what else needs changes if you implement UDP options. We can at least argue that this change should fix the function, not simplify it by changing its behavior.

I still would suggest to change cklen to assign to it the number of bytes the checksum will be computed over.

[timo.voelker_fh-muenster.de]

Use the same semantic for cklen as in the UDP case.