aboutsummaryrefslogtreecommitdiffstats
path: root/net/netfilter
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2022-01-05 16:09:57 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2022-01-06 10:43:23 +0100
commit4e1860a3863707e8177329c006d10f9e37e097a8 (patch)
treec79eb1919de9ee6c97544aae1e9e6224f845ed0f /net/netfilter
parentselftests: netfilter: switch to socat for tests using -q option (diff)
downloadlinux-dev-4e1860a3863707e8177329c006d10f9e37e097a8.tar.xz
linux-dev-4e1860a3863707e8177329c006d10f9e37e097a8.zip
netfilter: nft_payload: do not update layer 4 checksum when mangling fragments
IP fragments do not come with the transport header, hence skip bogus layer 4 checksum updates. Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
-rw-r--r--net/netfilter/nft_payload.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index bd689938a2e0..58e96a0fe0b4 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -546,6 +546,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt,
struct sk_buff *skb,
unsigned int *l4csum_offset)
{
+ if (pkt->fragoff)
+ return -1;
+
switch (pkt->tprot) {
case IPPROTO_TCP:
*l4csum_offset = offsetof(struct tcphdr, check);