mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
commit4e1860a386
upstream. IP fragments do not come with the transport header, hence skip bogus layer 4 checksum updates. Fixes:1814096980
("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
a6d5885725
commit
2bf7dee6f4
1 changed files with 3 additions and 0 deletions
|
@ -420,6 +420,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt,
|
|||
struct sk_buff *skb,
|
||||
unsigned int *l4csum_offset)
|
||||
{
|
||||
if (pkt->xt.fragoff)
|
||||
return -1;
|
||||
|
||||
switch (pkt->tprot) {
|
||||
case IPPROTO_TCP:
|
||||
*l4csum_offset = offsetof(struct tcphdr, check);
|
||||
|
|
Loading…
Reference in a new issue