The branch stable/14 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=9a34256fd915f759fa36df40f776a33b76926546
commit 9a34256fd915f759fa36df40f776a33b76926546 Author: Cy Schubert <[email protected]> AuthorDate: 2026-08-17 23:23:32 +0000 Commit: Cy Schubert <[email protected]> CommitDate: 2026-08-24 05:37:33 +0000 ipfilter: Fix checksum update for NAT_DIVERTOUT When taking a snapshot of the before ip_len (s1) for comparison with the after-translated ip_len (s2), we must convert it from network to host byte order before we can use it. Add the missing ntohs() call. PR: 296944 MFC after: 3 days (cherry picked from commit c08a97fa27b914988ef092352872b2f455abb7c3) --- sys/netpfil/ipfilter/netinet/ip_nat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c index 2ca0fee2606d..86e32b3bf750 100644 --- a/sys/netpfil/ipfilter/netinet/ip_nat.c +++ b/sys/netpfil/ipfilter/netinet/ip_nat.c @@ -5151,7 +5151,7 @@ ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags) ip_fillid(ip); s2 = ntohs(ip->ip_id); - s1 = ip->ip_len; + s1 = ntohs(ip->ip_len); ip->ip_len = ntohs(ip->ip_len); ip->ip_len += fin->fin_plen; ip->ip_len = htons(ip->ip_len);
