* [PATCH nft] netlink_linearize: fix IPv6 layer 4 checksum mangling
@ 2016-12-14 0:19 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2016-12-14 0:19 UTC (permalink / raw)
To: netfilter-devel
In IPv6 there is no checksum field, so we have to trigger layer 4
checksum mangling when layer 3 pseudoheader fields are updated
inconditionally.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Kernel patch is following up soon for nf.
src/netlink_linearize.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 4a0001a4ce17..0915038fecae 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -806,12 +806,11 @@ static void netlink_gen_payload_stmt(struct netlink_linearize_ctx *ctx,
NFT_PAYLOAD_CSUM_INET);
nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_CSUM_OFFSET,
csum_off / BITS_PER_BYTE);
-
- if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
- payload_needs_l4csum_update_pseudohdr(expr, desc))
- nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
- NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
}
+ if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
+ payload_needs_l4csum_update_pseudohdr(expr, desc))
+ nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
+ NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
nftnl_rule_add_expr(ctx->nlr, nle);
}
--
2.1.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2016-12-14 0:19 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-14 0:19 [PATCH nft] netlink_linearize: fix IPv6 layer 4 checksum mangling Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).