[PATCH v2 1/2] net/sched: act_nat: fix inner IP header checksum in ICMP error packets

David Carlier
2026-04-04T12:03:15Z

Update the inner IP header checksum when rewriting addresses
inside ICMP error payloads, matching netfilter's nf_nat_ipv4_manip_pkt()
behavior.

Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
net/sched/act_nat.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index abb332dee836..cd1d299da57c 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -242,7 +242,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
new_addr &= mask;
new_addr |= addr & ~mask;

- /* XXX Fix up the inner checksums. */
+ /* Update inner IP header checksum after address rewrite */
+ csum_replace4(&iph->check, addr, new_addr);
+
if (egress)
iph->daddr = new_addr;
else
--
2.53.0