* [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. @ 2013-01-26 18:37 YOSHIFUJI Hideaki 2013-01-29 14:42 ` Ulrich Weber 2013-02-07 18:14 ` Pablo Neira Ayuso 0 siblings, 2 replies; 7+ messages in thread From: YOSHIFUJI Hideaki @ 2013-01-26 18:37 UTC (permalink / raw) To: netfilter-devel; +Cc: jm, fw, yoshfuji Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate conversion function: csum_unfold() or csum_fold(). Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> --- net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c index 7302b0b..3ff281b 100644 --- a/net/ipv6/netfilter/ip6t_NPT.c +++ b/net/ipv6/netfilter/ip6t_NPT.c @@ -30,7 +30,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]); } - npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum); + npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); return 0; } @@ -66,8 +66,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, return false; } - sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx], - npt->adjustment); + sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), + csum_unfold(npt->adjustment))); if (sum == CSUM_MANGLED_0) sum = 0; *(__force __sum16 *)&addr->s6_addr16[idx] = sum; -- 1.7.9.5 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. 2013-01-26 18:37 [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming YOSHIFUJI Hideaki @ 2013-01-29 14:42 ` Ulrich Weber 2013-01-31 10:04 ` Pablo Neira Ayuso 2013-02-07 18:14 ` Pablo Neira Ayuso 1 sibling, 1 reply; 7+ messages in thread From: Ulrich Weber @ 2013-01-29 14:42 UTC (permalink / raw) To: YOSHIFUJI Hideaki; +Cc: netfilter-devel, jm, fw [-- Attachment #1: Type: text/plain, Size: 1397 bytes --] Hi Yoshofuji, thanks for your patches! If I add a onces complement to the return value of csum_fold() it works for my setup. Cheers Ulrich On 01/26/13 19:37, YOSHIFUJI Hideaki wrote: > Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate > conversion function: csum_unfold() or csum_fold(). > > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> > --- > net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c > index 7302b0b..3ff281b 100644 > --- a/net/ipv6/netfilter/ip6t_NPT.c > +++ b/net/ipv6/netfilter/ip6t_NPT.c > @@ -30,7 +30,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) > (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]); > } > > - npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum); > + npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); > return 0; > } > > @@ -66,8 +66,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, > return false; > } > > - sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx], > - npt->adjustment); > + sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), > + csum_unfold(npt->adjustment))); > if (sum == CSUM_MANGLED_0) > sum = 0; > *(__force __sum16 *)&addr->s6_addr16[idx] = sum; [-- Attachment #2: 0001-netfilter-ip6t_NTP-Use-onces-complement-of-csum_fold.patch --] [-- Type: text/x-patch, Size: 1412 bytes --] >From 40e0c6d86514a8dcc80f18fbe8a2945c6ee78f6d Mon Sep 17 00:00:00 2001 From: Ulrich Weber <ulrich.weber@sophos.com> Date: Tue, 29 Jan 2013 15:24:21 +0100 Subject: [PATCH] netfilter: ip6t_NTP: Use onces complement of csum_fold we need a 16bit value but not folded Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> --- net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c index 74e171d..61a9b95 100644 --- a/net/ipv6/netfilter/ip6t_NPT.c +++ b/net/ipv6/netfilter/ip6t_NPT.c @@ -35,7 +35,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0); dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0); - npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); + npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum)); return 0; } @@ -71,8 +71,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, return false; } - sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), - csum_unfold(npt->adjustment))); + sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), + csum_unfold(npt->adjustment))); if (sum == CSUM_MANGLED_0) sum = 0; *(__force __sum16 *)&addr->s6_addr16[idx] = sum; -- 1.7.9.5 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. 2013-01-29 14:42 ` Ulrich Weber @ 2013-01-31 10:04 ` Pablo Neira Ayuso 2013-01-31 15:59 ` Ulrich Weber 0 siblings, 1 reply; 7+ messages in thread From: Pablo Neira Ayuso @ 2013-01-31 10:04 UTC (permalink / raw) To: Ulrich Weber; +Cc: YOSHIFUJI Hideaki, netfilter-devel, jm, fw Hi, On Tue, Jan 29, 2013 at 03:42:39PM +0100, Ulrich Weber wrote: > Hi Yoshofuji, > > thanks for your patches! If I add a onces complement > to the return value of csum_fold() it works for my setup. Any consensus on the fix for this? I'd like to have some solution into 3.8-rc. Thanks. > On 01/26/13 19:37, YOSHIFUJI Hideaki wrote: > > Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate > > conversion function: csum_unfold() or csum_fold(). > > > > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> > > --- > > net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c > > index 7302b0b..3ff281b 100644 > > --- a/net/ipv6/netfilter/ip6t_NPT.c > > +++ b/net/ipv6/netfilter/ip6t_NPT.c > > @@ -30,7 +30,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) > > (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]); > > } > > > > - npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum); > > + npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); > > return 0; > > } > > > > @@ -66,8 +66,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, > > return false; > > } > > > > - sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx], > > - npt->adjustment); > > + sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), > > + csum_unfold(npt->adjustment))); > > if (sum == CSUM_MANGLED_0) > > sum = 0; > > *(__force __sum16 *)&addr->s6_addr16[idx] = sum; > > From 40e0c6d86514a8dcc80f18fbe8a2945c6ee78f6d Mon Sep 17 00:00:00 2001 > From: Ulrich Weber <ulrich.weber@sophos.com> > Date: Tue, 29 Jan 2013 15:24:21 +0100 > Subject: [PATCH] netfilter: ip6t_NTP: Use onces complement of csum_fold > > we need a 16bit value but not folded > > Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> > --- > net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c > index 74e171d..61a9b95 100644 > --- a/net/ipv6/netfilter/ip6t_NPT.c > +++ b/net/ipv6/netfilter/ip6t_NPT.c > @@ -35,7 +35,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) > src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0); > dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0); > > - npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); > + npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum)); > return 0; > } > > @@ -71,8 +71,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, > return false; > } > > - sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), > - csum_unfold(npt->adjustment))); > + sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), > + csum_unfold(npt->adjustment))); > if (sum == CSUM_MANGLED_0) > sum = 0; > *(__force __sum16 *)&addr->s6_addr16[idx] = sum; > -- > 1.7.9.5 > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. 2013-01-31 10:04 ` Pablo Neira Ayuso @ 2013-01-31 15:59 ` Ulrich Weber 2013-01-31 18:45 ` Jean-Michel DILLY 2013-02-03 22:31 ` Jean-Michel DILLY 0 siblings, 2 replies; 7+ messages in thread From: Ulrich Weber @ 2013-01-31 15:59 UTC (permalink / raw) To: Pablo Neira Ayuso; +Cc: YOSHIFUJI Hideaki, netfilter-devel, jm, fw From my side, apply yoshofuji patches and my onces complement patch, that worked for me ;) I can do some more testing tomorrow with different addresses and ranges if nobody else finds time... Cheers Ulrich On 01/31/13 11:04, Pablo Neira Ayuso wrote: > Hi, > > On Tue, Jan 29, 2013 at 03:42:39PM +0100, Ulrich Weber wrote: >> Hi Yoshofuji, >> >> thanks for your patches! If I add a onces complement >> to the return value of csum_fold() it works for my setup. > Any consensus on the fix for this? I'd like to have some solution into > 3.8-rc. > > Thanks. > >> On 01/26/13 19:37, YOSHIFUJI Hideaki wrote: >>> Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate >>> conversion function: csum_unfold() or csum_fold(). >>> >>> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> >>> --- >>> net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- >>> 1 file changed, 3 insertions(+), 3 deletions(-) >>> >>> diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c >>> index 7302b0b..3ff281b 100644 >>> --- a/net/ipv6/netfilter/ip6t_NPT.c >>> +++ b/net/ipv6/netfilter/ip6t_NPT.c >>> @@ -30,7 +30,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) >>> (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]); >>> } >>> >>> - npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum); >>> + npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); >>> return 0; >>> } >>> >>> @@ -66,8 +66,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, >>> return false; >>> } >>> >>> - sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx], >>> - npt->adjustment); >>> + sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>> + csum_unfold(npt->adjustment))); >>> if (sum == CSUM_MANGLED_0) >>> sum = 0; >>> *(__force __sum16 *)&addr->s6_addr16[idx] = sum; >> From 40e0c6d86514a8dcc80f18fbe8a2945c6ee78f6d Mon Sep 17 00:00:00 2001 >> From: Ulrich Weber <ulrich.weber@sophos.com> >> Date: Tue, 29 Jan 2013 15:24:21 +0100 >> Subject: [PATCH] netfilter: ip6t_NTP: Use onces complement of csum_fold >> >> we need a 16bit value but not folded >> >> Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> >> --- >> net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- >> 1 file changed, 3 insertions(+), 3 deletions(-) >> >> diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c >> index 74e171d..61a9b95 100644 >> --- a/net/ipv6/netfilter/ip6t_NPT.c >> +++ b/net/ipv6/netfilter/ip6t_NPT.c >> @@ -35,7 +35,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) >> src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0); >> dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0); >> >> - npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); >> + npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum)); >> return 0; >> } >> >> @@ -71,8 +71,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, >> return false; >> } >> >> - sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >> - csum_unfold(npt->adjustment))); >> + sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >> + csum_unfold(npt->adjustment))); >> if (sum == CSUM_MANGLED_0) >> sum = 0; >> *(__force __sum16 *)&addr->s6_addr16[idx] = sum; >> -- >> 1.7.9.5 >> ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. 2013-01-31 15:59 ` Ulrich Weber @ 2013-01-31 18:45 ` Jean-Michel DILLY 2013-02-03 22:31 ` Jean-Michel DILLY 1 sibling, 0 replies; 7+ messages in thread From: Jean-Michel DILLY @ 2013-01-31 18:45 UTC (permalink / raw) To: Ulrich Weber; +Cc: Pablo Neira Ayuso, YOSHIFUJI Hideaki, netfilter-devel, fw [-- Attachment #1: Type: text/plain, Size: 3729 bytes --] I'll make some tests this week-end. I have had no time theses days. Regards, Jean-Michel Le 31 janv. 2013 à 16:59, Ulrich Weber a écrit : > From my side, apply yoshofuji patches and my > onces complement patch, that worked for me ;) > > I can do some more testing tomorrow with different > addresses and ranges if nobody else finds time... > > Cheers > Ulrich > > > On 01/31/13 11:04, Pablo Neira Ayuso wrote: >> Hi, >> >> On Tue, Jan 29, 2013 at 03:42:39PM +0100, Ulrich Weber wrote: >>> Hi Yoshofuji, >>> >>> thanks for your patches! If I add a onces complement >>> to the return value of csum_fold() it works for my setup. >> Any consensus on the fix for this? I'd like to have some solution into >> 3.8-rc. >> >> Thanks. >> >>> On 01/26/13 19:37, YOSHIFUJI Hideaki wrote: >>>> Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate >>>> conversion function: csum_unfold() or csum_fold(). >>>> >>>> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> >>>> --- >>>> net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- >>>> 1 file changed, 3 insertions(+), 3 deletions(-) >>>> >>>> diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c >>>> index 7302b0b..3ff281b 100644 >>>> --- a/net/ipv6/netfilter/ip6t_NPT.c >>>> +++ b/net/ipv6/netfilter/ip6t_NPT.c >>>> @@ -30,7 +30,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) >>>> (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]); >>>> } >>>> - npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum); >>>> + npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); >>>> return 0; >>>> } >>>> @@ -66,8 +66,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, >>>> return false; >>>> } >>>> - sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx], >>>> - npt->adjustment); >>>> + sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>>> + csum_unfold(npt->adjustment))); >>>> if (sum == CSUM_MANGLED_0) >>>> sum = 0; >>>> *(__force __sum16 *)&addr->s6_addr16[idx] = sum; >>> From 40e0c6d86514a8dcc80f18fbe8a2945c6ee78f6d Mon Sep 17 00:00:00 2001 >>> From: Ulrich Weber <ulrich.weber@sophos.com> >>> Date: Tue, 29 Jan 2013 15:24:21 +0100 >>> Subject: [PATCH] netfilter: ip6t_NTP: Use onces complement of csum_fold >>> >>> we need a 16bit value but not folded >>> >>> Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> >>> --- >>> net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- >>> 1 file changed, 3 insertions(+), 3 deletions(-) >>> >>> diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c >>> index 74e171d..61a9b95 100644 >>> --- a/net/ipv6/netfilter/ip6t_NPT.c >>> +++ b/net/ipv6/netfilter/ip6t_NPT.c >>> @@ -35,7 +35,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) >>> src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0); >>> dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0); >>> - npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); >>> + npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum)); >>> return 0; >>> } >>> @@ -71,8 +71,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, >>> return false; >>> } >>> - sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>> - csum_unfold(npt->adjustment))); >>> + sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>> + csum_unfold(npt->adjustment))); >>> if (sum == CSUM_MANGLED_0) >>> sum = 0; >>> *(__force __sum16 *)&addr->s6_addr16[idx] = sum; >>> -- >>> 1.7.9.5 >>> > [-- Attachment #2: smime.p7s --] [-- Type: application/pkcs7-signature, Size: 4328 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. 2013-01-31 15:59 ` Ulrich Weber 2013-01-31 18:45 ` Jean-Michel DILLY @ 2013-02-03 22:31 ` Jean-Michel DILLY 1 sibling, 0 replies; 7+ messages in thread From: Jean-Michel DILLY @ 2013-02-03 22:31 UTC (permalink / raw) To: Ulrich Weber; +Cc: Pablo Neira Ayuso, YOSHIFUJI Hideaki, netfilter-devel, fw [-- Attachment #1: Type: text/plain, Size: 3690 bytes --] Looks good from here. :) Regards, JMichel DILLY Le 31 janv. 2013 à 16:59, Ulrich Weber a écrit : > From my side, apply yoshofuji patches and my > onces complement patch, that worked for me ;) > > I can do some more testing tomorrow with different > addresses and ranges if nobody else finds time... > > Cheers > Ulrich > > > On 01/31/13 11:04, Pablo Neira Ayuso wrote: >> Hi, >> >> On Tue, Jan 29, 2013 at 03:42:39PM +0100, Ulrich Weber wrote: >>> Hi Yoshofuji, >>> >>> thanks for your patches! If I add a onces complement >>> to the return value of csum_fold() it works for my setup. >> Any consensus on the fix for this? I'd like to have some solution into >> 3.8-rc. >> >> Thanks. >> >>> On 01/26/13 19:37, YOSHIFUJI Hideaki wrote: >>>> Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate >>>> conversion function: csum_unfold() or csum_fold(). >>>> >>>> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> >>>> --- >>>> net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- >>>> 1 file changed, 3 insertions(+), 3 deletions(-) >>>> >>>> diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c >>>> index 7302b0b..3ff281b 100644 >>>> --- a/net/ipv6/netfilter/ip6t_NPT.c >>>> +++ b/net/ipv6/netfilter/ip6t_NPT.c >>>> @@ -30,7 +30,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) >>>> (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]); >>>> } >>>> - npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum); >>>> + npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); >>>> return 0; >>>> } >>>> @@ -66,8 +66,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, >>>> return false; >>>> } >>>> - sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx], >>>> - npt->adjustment); >>>> + sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>>> + csum_unfold(npt->adjustment))); >>>> if (sum == CSUM_MANGLED_0) >>>> sum = 0; >>>> *(__force __sum16 *)&addr->s6_addr16[idx] = sum; >>> From 40e0c6d86514a8dcc80f18fbe8a2945c6ee78f6d Mon Sep 17 00:00:00 2001 >>> From: Ulrich Weber <ulrich.weber@sophos.com> >>> Date: Tue, 29 Jan 2013 15:24:21 +0100 >>> Subject: [PATCH] netfilter: ip6t_NTP: Use onces complement of csum_fold >>> >>> we need a 16bit value but not folded >>> >>> Signed-off-by: Ulrich Weber <ulrich.weber@sophos.com> >>> --- >>> net/ipv6/netfilter/ip6t_NPT.c | 6 +++--- >>> 1 file changed, 3 insertions(+), 3 deletions(-) >>> >>> diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c >>> index 74e171d..61a9b95 100644 >>> --- a/net/ipv6/netfilter/ip6t_NPT.c >>> +++ b/net/ipv6/netfilter/ip6t_NPT.c >>> @@ -35,7 +35,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) >>> src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0); >>> dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0); >>> - npt->adjustment = csum_fold(csum_sub(src_sum, dst_sum)); >>> + npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum)); >>> return 0; >>> } >>> @@ -71,8 +71,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt, >>> return false; >>> } >>> - sum = csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>> - csum_unfold(npt->adjustment))); >>> + sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]), >>> + csum_unfold(npt->adjustment))); >>> if (sum == CSUM_MANGLED_0) >>> sum = 0; >>> *(__force __sum16 *)&addr->s6_addr16[idx] = sum; >>> -- >>> 1.7.9.5 >>> > [-- Attachment #2: smime.p7s --] [-- Type: application/pkcs7-signature, Size: 4328 bytes --] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming. 2013-01-26 18:37 [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming YOSHIFUJI Hideaki 2013-01-29 14:42 ` Ulrich Weber @ 2013-02-07 18:14 ` Pablo Neira Ayuso 1 sibling, 0 replies; 7+ messages in thread From: Pablo Neira Ayuso @ 2013-02-07 18:14 UTC (permalink / raw) To: YOSHIFUJI Hideaki; +Cc: netfilter-devel, jm, fw, Ulrich Weber On Sun, Jan 27, 2013 at 03:37:48AM +0900, YOSHIFUJI Hideaki wrote: > Cast __wsum from/to __sum16 is wrong. Instead, apply appropriate > conversion function: csum_unfold() or csum_fold(). Applied. I have mangled this patch by collapsing Ulrich's: http://patchwork.ozlabs.org/patch/216563/ And I have added this to the description: [ The original patch has been modified to undo the final ~ that csum_fold returns. We only need to fold the 32-bit word that results from the checksum calculation into a 16-bit to ensure that the original subnet is restored appropriately. Spotted by Ulrich Weber. ] Thanks. ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2013-02-07 18:14 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-01-26 18:37 [RFC PATCH 1/4] netfilter: ip6t_NPT: Fix checksuming YOSHIFUJI Hideaki 2013-01-29 14:42 ` Ulrich Weber 2013-01-31 10:04 ` Pablo Neira Ayuso 2013-01-31 15:59 ` Ulrich Weber 2013-01-31 18:45 ` Jean-Michel DILLY 2013-02-03 22:31 ` Jean-Michel DILLY 2013-02-07 18:14 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).