Re: [PATCH] netfilter: fix bad checksum on IPv6 when NAT is performed

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Oct 06, 2015 at 04:10:52PM +0200, Maxime Bizon wrote:
> 
> With this setup:
> 
> * non IPv6 checksumming capable network hardware
> * GRO off
> * IPv6 SNAT
> 
> I get this when I receive an UDPv6 reply: "<unknown>: hw csum failure"
> 
> Call trace:
> 
> * nf_ip6_checksum() calls __skb_checksum_complete()
> * nf_nat_ipv6_csum_update() & nf_nat_ipv6_manip_pkt()
> * __udp6_lib_rcv() => udp6_csum_init()
> * __skb_checksum_validate_complete() "fastpath" fails because
>   skb->csum is incorrect.
> * udpv6_recvmsg() => skb_copy_and_csum_datagram_msg()
> 
> The last call computes a valid checksum despite CHECKSUM_COMPLETE and
> triggers the warning.
> 
> When we perform NAT on IPv4, we also update the IPv4 checksum, so
> there is no side effect on skb->csum (since the csum over a valid IPv4
> header area is zero).
> 
> But IPv6 doesn't have such header checksum, so when performing NAT we need to
> update skb->csum.

Please, resubmit and Cc netfilter-devel@vger.kernel.org.

Thanks.