]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: Wrong icmp6 checksum for ICMPV6_TIME_EXCEED in reverse SNATv6 path
authorDave Johnson <dave-kernel@centerclick.org>
Mon, 24 Apr 2017 13:11:24 +0000 (09:11 -0400)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 25 Apr 2017 09:10:38 +0000 (11:10 +0200)
commit9cb7f907ffdfce398f24945c8f7b8d54f2514a29
tree269ceeff49482d9113feff5b79b5a69e7dfd39ae
parentd50978a8d26d4ac6d5624618727e5f9b22b6e5d2
netfilter: Wrong icmp6 checksum for ICMPV6_TIME_EXCEED in reverse SNATv6 path

When recalculating the outer ICMPv6 checksum for a reverse path NATv6
such as ICMPV6_TIME_EXCEED nf_nat_icmpv6_reply_translation() was
accessing data beyond the headlen of the skb for non-linear skb.  This
resulted in incorrect ICMPv6 checksum as garbage data was used.

Patch replaces csum_partial() with skb_checksum() which supports
non-linear skbs similar to nf_nat_icmp_reply_translation() from ipv4.

Signed-off-by: Dave Johnson <dave-kernel@centerclick.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/ipv6/netfilter/nf_nat_l3proto_ipv6.c