nbuf_cksum_barrier returns true when the direction is PFIL_OUT and TSO is
active; that is to say, it returns true when the checksum was already
recomputed by the function.
The check should be !nbuf_cksum_barrier, because otherwise we're wrongfully
checksumming twice, and it causes the packet to be kicked later in
tcp_input.
This can be seen with a configuration of the type:
procedure "norm" {
normalize: "max-mss" 15000
}
group default {
pass all apply "norm"
}
The packets systematically get dropped because the checksum validation in
tcp_input fails. With this patch in place, it works.
fa6e6f537b