Index: contrib/ipfilter/ip_fil.c =================================================================== --- contrib/ipfilter/ip_fil.c (revision 312856) +++ contrib/ipfilter/ip_fil.c (working copy) @@ -840,8 +840,9 @@ u_int -ipf_pcksum(fin, hlen, sum) +ipf_pcksum(fin, ip, hlen, sum) fr_info_t *fin; + ip_t *ip; int hlen; u_int sum; { @@ -849,6 +850,8 @@ u_int sum2; int slen; + ip = ip; /* gcc -Wextra */ + slen = fin->fin_plen - hlen; sp = (u_short *)((u_char *)fin->fin_ip + hlen); Index: sys/contrib/ipfilter/netinet/fil.c =================================================================== --- sys/contrib/ipfilter/netinet/fil.c (revision 312856) +++ sys/contrib/ipfilter/netinet/fil.c (working copy) @@ -3465,11 +3465,16 @@ sum += *sp++; sum += *sp++; /* ip_dst */ sum += *sp++; + slen = fin->fin_plen - off; + sum += htons(slen); #ifdef USE_INET6 } else if (IP_V(ip) == 6) { +#if 0 ip6 = (ip6_t *)ip; hlen = sizeof(*ip6); +#endif off = ((char *)fin->fin_dp - (char *)fin->fin_ip); +#if 0 sp = (u_short *)&ip6->ip6_src; sum += *sp++; /* ip6_src */ sum += *sp++; @@ -3488,12 +3493,13 @@ sum += *sp++; sum += *sp++; sum += *sp++; +#else + sum = 0; +#endif } else { return 0xffff; } #endif - slen = fin->fin_plen - off; - sum += htons(slen); switch (l4proto) { @@ -3522,7 +3528,7 @@ *csump = 0; } - sum2 = ipf_pcksum(fin, off, sum); + sum2 = ipf_pcksum(fin, ip, off, sum); if (csump != NULL) *csump = sumsave; return sum2; @@ -6719,10 +6725,15 @@ #ifdef USE_INET6 case IPPROTO_ICMPV6 : +#if 0 csump = &((struct icmp6_hdr *)fin->fin_dp)->icmp6_cksum; dosum = 1; break; +#else + fin->fin_cksum = FI_CK_SUMOK; + return 0; #endif +#endif case IPPROTO_ICMP : csump = &((struct icmp *)fin->fin_dp)->icmp_cksum; Index: sys/contrib/ipfilter/netinet/ip_fil.h =================================================================== --- sys/contrib/ipfilter/netinet/ip_fil.h (revision 312856) +++ sys/contrib/ipfilter/netinet/ip_fil.h (working copy) @@ -1936,7 +1936,7 @@ extern int ipf_matchicmpqueryreply __P((int, icmpinfo_t *, struct icmp *, int)); extern u_32_t ipf_newisn __P((fr_info_t *)); -extern u_int ipf_pcksum __P((fr_info_t *, int, u_int)); +extern u_int ipf_pcksum __P((fr_info_t *, ip_t *, int, u_int)); extern void ipf_rule_expire __P((ipf_main_softc_t *)); extern int ipf_scanlist __P((fr_info_t *, u_32_t)); extern frentry_t *ipf_srcgrpmap __P((fr_info_t *, u_32_t *)); Index: sys/contrib/ipfilter/netinet/ip_fil_freebsd.c =================================================================== --- sys/contrib/ipfilter/netinet/ip_fil_freebsd.c (revision 312856) +++ sys/contrib/ipfilter/netinet/ip_fil_freebsd.c (working copy) @@ -1456,8 +1456,9 @@ u_int -ipf_pcksum(fin, hlen, sum) +ipf_pcksum(fin, ip, hlen, sum) fr_info_t *fin; + ip_t *ip; int hlen; u_int sum; { @@ -1467,12 +1468,29 @@ m = fin->fin_m; off = (char *)fin->fin_dp - (char *)fin->fin_ip; - m->m_data += hlen; - m->m_len -= hlen; - sum2 = in_cksum(fin->fin_m, fin->fin_plen - off); - m->m_len += hlen; - m->m_data -= hlen; +#ifdef USE_INET6 + if (IP_V(ip) == 4) { +#endif + m->m_data += hlen; + m->m_len -= hlen; + sum2 = in_cksum(fin->fin_m, fin->fin_plen - off); + m->m_len += hlen; + m->m_data -= hlen; +#ifdef USE_INET6 + } else if (IP_V(ip) == 6) { + ip6_t *ip6; + if (m->m_len < sizeof(struct ip6_hdr)) + return 0xffff; + + ip6 = (ip6_t *)ip; + sum2 = in6_cksum(m, ip6->ip6_nxt, hlen, m->m_len - hlen); + return(sum2); + } else { + return 0xffff; + } +#endif + /* * Both sum and sum2 are partial sums, so combine them together. */