Bug 222160

Summary: Lack of TCP/UDP checksum recalculation in IPSec implementation
Product: Base System Reporter: Victor Volpe <victor_volpe>
Component: kernAssignee: Andrey V. Elsukov <ae>
Status: Closed Not Accepted    
Severity: Affects Many People CC: emaste, eugen
Priority: ---    
Version: 10.3-RELEASE   
Hardware: Any   
OS: Any   

Description Victor Volpe 2017-09-09 04:20:50 UTC 
Bug 146190 shows that there is no code in FreeBSD kernel to handle TCP/UDP checksums of packets protected by ESP.

Andrey V. Elsukov reported that the bugfix was merged in 11-STABLE, but this need to be merged on all supported versions, like 10.3-RELEASE.

I'm using a kind of "butchering" in the UDP checksum function, to get rid of checksum mismatch, but that is not the correct fix.

Please take actions about this ASAP!
Comment 1 Ed Maste freebsd_committer freebsd_triage 2017-09-09 15:12:25 UTC 
Is r316770 the fix? https://svnweb.freebsd.org/changeset/base/316770
Comment 2 Eugene Grosbein freebsd_committer freebsd_triage 2017-09-09 18:34:07 UTC 
Andrey may have something to say on this topic.
Comment 3 Andrey V. Elsukov freebsd_committer freebsd_triage 2017-09-09 21:00:51 UTC 
(In reply to Eugene Grosbein from comment #2)
> Andrey may have something to say on this topic.

I don't plan to merge something into stable/10. Feel free to do it if you want.
Comment 4 Andrey V. Elsukov freebsd_committer freebsd_triage 2017-09-09 21:47:49 UTC 
(In reply to Ed Maste from comment #1)
> Is r316770 the fix? https://svnweb.freebsd.org/changeset/base/316770

No, this one is unrelated. I think this should be r309808,312345 and some later fixes. It will be not easy to merge this feature without merging the whole IPsec stack implementation from head/. And this also requires some changes to IP/IP6 stack. You can just use stable/11 instead.
Comment 5 Victor Volpe 2017-09-10 02:25:07 UTC 
(In reply to Andrey V. Elsukov from comment #3)
> I don't plan to merge something into stable/10. Feel free to do it if you want.

"If you want fixes, move to 11-STABLE." Great! So, previous versions must be discontinued as well!

Thank you... not!