Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2196520/?format=api
{ "id": 2196520, "url": "http://patchwork.ozlabs.org/api/patches/2196520/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260214145850.18130-2-ja@ssi.bg/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260214145850.18130-2-ja@ssi.bg>", "list_archive_url": null, "date": "2026-02-14T14:58:49", "name": "[nf,1/2] ipvs: skip ipv6 extension headers for csum checks", "commit_ref": null, "pull_url": null, "state": "under-review", "archived": false, "hash": "4118ed6e815a6282cd2a7bd3dcc4645fec265585", "submitter": { "id": 2825, "url": "http://patchwork.ozlabs.org/api/people/2825/?format=api", "name": "Julian Anastasov", "email": "ja@ssi.bg" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260214145850.18130-2-ja@ssi.bg/mbox/", "series": [ { "id": 492176, "url": "http://patchwork.ozlabs.org/api/series/492176/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=492176", "date": "2026-02-14T14:58:50", "name": "IPVS changes, part 1 of 4 - fixes", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/492176/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2196520/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2196520/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-10770-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (4096-bit key;\n unprotected) header.d=ssi.bg header.i=@ssi.bg header.a=rsa-sha256\n header.s=ssi header.b=G/vdMfom;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c15:e001:75::12fc:5321; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-10770-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=\"G/vdMfom\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=193.238.174.39", "smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=ssi.bg" ], "Received": [ "from sin.lore.kernel.org (sin.lore.kernel.org\n [IPv6:2600:3c15:e001:75::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fCsjP1zNTz23hV\n\tfor <incoming@patchwork.ozlabs.org>; Sun, 15 Feb 2026 02:03:05 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id 6155930055F0\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 14 Feb 2026 15:03:03 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 9A15427B343;\n\tSat, 14 Feb 2026 15:03:02 +0000 (UTC)", "from mx.ssi.bg (mx.ssi.bg [193.238.174.39])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id CF43C1C695;\n\tSat, 14 Feb 2026 15:02:58 +0000 (UTC)", "from mx.ssi.bg (localhost [127.0.0.1])\n\tby mx.ssi.bg (Potsfix) with ESMTP id C2E4521D5E;\n\tSat, 14 Feb 2026 17:02:47 +0200 (EET)", "from box.ssi.bg (box.ssi.bg [193.238.174.46])\n\tby mx.ssi.bg (Potsfix) with ESMTPS;\n\tSat, 14 Feb 2026 17:02:46 +0200 (EET)", "from ja.ssi.bg (unknown [213.16.62.126])\n\tby box.ssi.bg (Potsfix) with ESMTPSA id BB64B61B7A;\n\tSat, 14 Feb 2026 17:02:45 +0200 (EET)", "from ja.home.ssi.bg (localhost.localdomain [127.0.0.1])\n\tby ja.ssi.bg (8.18.1/8.18.1) with ESMTP id 61EExQN7018155;\n\tSat, 14 Feb 2026 16:59:26 +0200", "(from root@localhost)\n\tby ja.home.ssi.bg (8.18.1/8.18.1/Submit) id 61EExQGs018154;\n\tSat, 14 Feb 2026 16:59:26 +0200" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1771081381; cv=none;\n b=fjqD7XfC3tQEjWGEPqPVuW9NyoGoxPt/8Iyk5jivdB9UC1j3fo5Qy7PHRi2ufVWWnr6I+0TRUvKvakAlO5370GRIqCnEQAmjpz63MtoU/t87voeN1uJmGp2GBTEHMhG4Fbmp3tjQEmQZ8I68OfmxWsmJjzu9bQS6pfgd4KL6dHU=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1771081381; c=relaxed/simple;\n\tbh=Z76lPNw9Qnm7s9Si1BvxRelZ+70cOeH1hJvRPnUjLOI=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=pmu90zDKKA5KHL/Vp92GbhApKiHbkeH7lwN9/CgUcMQJ18PPdGIf8oaYqgCrwawHMqUPkYOaheoAVuP+WsEX6U8nEnclTBhjlnIkd56ZqTlnK17OF9R5moPitG/HzU3bHQA3rkH3GPGAzdOqcNCVnt4G8prwYcBlGoIgwNzjmro=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=reject dis=none) header.from=ssi.bg;\n spf=pass smtp.mailfrom=ssi.bg;\n dkim=pass (4096-bit key) header.d=ssi.bg header.i=@ssi.bg header.b=G/vdMfom;\n arc=none smtp.client-ip=193.238.174.39", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=ssi.bg; h=cc:cc\n\t:content-transfer-encoding:date:from:from:in-reply-to:message-id\n\t:mime-version:references:reply-to:subject:subject:to:to; s=ssi;\n\t bh=bVMdL08QxUYmC960pslnT4RVv3rGrXwSH7KeCnzBnJY=; b=G/vdMfomxPce\n\t09nqu1vG+xUU41BGNFeDl0v41C204NPjakPxOghdHgA1agGfCv4DriOvha+51tKb\n\t4PPO1fzJsNkYz4haTbVSbb2sGQYFwcaY0PY7TLagT6ryIJN+QUwU3gSls3YQiN7N\n\tR3cu6rZV9zJ0NS/QEsIrVbIFEyXgbVc13QfkwkxwrvFK6oCJUy5Xu9D1s3nCEKBu\n\tYk/ASyUiHbT7UqA7EexBRPPSP/QrBGlssOkm0zVEb6cZxUzh31or/YDVU9t5CKFv\n\tLymZg7c6JmsPcxzUXz5A5QQmc0KRPuKSlCuE8uZV2Ut+2qz7nSU4CK+K+7qmjo10\n\tr2fiJIomKIUePHJXOU3Y7bMW46h2hwS/rk2tXRS0s0o38uL2iGbjIoZtrl8maZbc\n\tQfGIu6PxHP7Rz7mnVXVHCUGwtYCjHgL1tzx6WoIomxwTb3KXwPnrDqc1ygHPoGXb\n\tE1cBmr98nCfhoflRp3UNRdbwu8tlGge1NWGDocpxOWy4sEMvXq3NqdeUmQTdZcj8\n\tL7iVJIYVqdKtTn5Hy0cO2PufTbFP9nxPITP/LujBLMfib5rL0oyjwf4nZCtuAaex\n\tRVaSH1vd28e5H+eU6QI+kzpGO+3Ltqn1D5ZIjv6f4MfAYYJ5LEMwju6kooH+k7NU\n\t+wTMJTGs5puQO7HpnlYQAt/AYwI/Qas=", "From": "Julian Anastasov <ja@ssi.bg>", "To": "Simon Horman <horms@verge.net.au>", "Cc": "Pablo Neira Ayuso <pablo@netfilter.org>, lvs-devel@vger.kernel.org,\n netfilter-devel@vger.kernel.org, Dust Li <dust.li@linux.alibaba.com>,\n Jiejian Wu <jiejian@linux.alibaba.com>", "Subject": "[PATCH nf 1/2] ipvs: skip ipv6 extension headers for csum checks", "Date": "Sat, 14 Feb 2026 16:58:49 +0200", "Message-ID": "<20260214145850.18130-2-ja@ssi.bg>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<20260214145850.18130-1-ja@ssi.bg>", "References": "<20260214145850.18130-1-ja@ssi.bg>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Protocol checksum validation fails for IPv6 if there are extension\nheaders before the protocol header. iph->len already contains its\noffset, so use it to fix the problem.\n\nFixes: 2906f66a5682 (\"ipvs: SCTP Trasport Loadbalancing Support\")\nFixes: 0bbdd42b7efa (\"IPVS: Extend protocol DNAT/SNAT and state handlers\")\nSigned-off-by: Julian Anastasov <ja@ssi.bg>\n---\n net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 ++++++------------\n net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +++++++--------------\n net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +++++++-------------\n 3 files changed, 20 insertions(+), 39 deletions(-)", "diff": "diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c\nindex 83e452916403..63c78a1f3918 100644\n--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c\n+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c\n@@ -10,7 +10,8 @@\n #include <net/ip_vs.h>\n \n static int\n-sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);\n+sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,\n+\t\tunsigned int sctphoff);\n \n static int\n sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n@@ -108,7 +109,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \t\tint ret;\n \n \t\t/* Some checks before mangling */\n-\t\tif (!sctp_csum_check(cp->af, skb, pp))\n+\t\tif (!sctp_csum_check(cp->af, skb, pp, sctphoff))\n \t\t\treturn 0;\n \n \t\t/* Call application helper if needed */\n@@ -156,7 +157,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \t\tint ret;\n \n \t\t/* Some checks before mangling */\n-\t\tif (!sctp_csum_check(cp->af, skb, pp))\n+\t\tif (!sctp_csum_check(cp->af, skb, pp, sctphoff))\n \t\t\treturn 0;\n \n \t\t/* Call application helper if needed */\n@@ -185,19 +186,12 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n }\n \n static int\n-sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)\n+sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,\n+\t\tunsigned int sctphoff)\n {\n-\tunsigned int sctphoff;\n \tstruct sctphdr *sh;\n \t__le32 cmp, val;\n \n-#ifdef CONFIG_IP_VS_IPV6\n-\tif (af == AF_INET6)\n-\t\tsctphoff = sizeof(struct ipv6hdr);\n-\telse\n-#endif\n-\t\tsctphoff = ip_hdrlen(skb);\n-\n \tsh = (struct sctphdr *)(skb->data + sctphoff);\n \tcmp = sh->checksum;\n \tval = sctp_compute_cksum(skb, sctphoff);\ndiff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c\nindex f68a1533ee45..8cc0a8ce6241 100644\n--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c\n+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c\n@@ -28,7 +28,8 @@\n #include <net/ip_vs.h>\n \n static int\n-tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);\n+tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,\n+\t unsigned int tcphoff);\n \n static int\n tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n@@ -165,7 +166,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \t\tint ret;\n \n \t\t/* Some checks before mangling */\n-\t\tif (!tcp_csum_check(cp->af, skb, pp))\n+\t\tif (!tcp_csum_check(cp->af, skb, pp, tcphoff))\n \t\t\treturn 0;\n \n \t\t/* Call application helper if needed */\n@@ -243,7 +244,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \t\tint ret;\n \n \t\t/* Some checks before mangling */\n-\t\tif (!tcp_csum_check(cp->af, skb, pp))\n+\t\tif (!tcp_csum_check(cp->af, skb, pp, tcphoff))\n \t\t\treturn 0;\n \n \t\t/*\n@@ -300,17 +301,9 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \n \n static int\n-tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)\n+tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,\n+\t unsigned int tcphoff)\n {\n-\tunsigned int tcphoff;\n-\n-#ifdef CONFIG_IP_VS_IPV6\n-\tif (af == AF_INET6)\n-\t\ttcphoff = sizeof(struct ipv6hdr);\n-\telse\n-#endif\n-\t\ttcphoff = ip_hdrlen(skb);\n-\n \tswitch (skb->ip_summed) {\n \tcase CHECKSUM_NONE:\n \t\tskb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0);\n@@ -321,7 +314,7 @@ tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)\n \t\t\tif (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,\n \t\t\t\t\t &ipv6_hdr(skb)->daddr,\n \t\t\t\t\t skb->len - tcphoff,\n-\t\t\t\t\t ipv6_hdr(skb)->nexthdr,\n+\t\t\t\t\t IPPROTO_TCP,\n \t\t\t\t\t skb->csum)) {\n \t\t\t\tIP_VS_DBG_RL_PKT(0, af, pp, skb, 0,\n \t\t\t\t\t\t \"Failed checksum for\");\ndiff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c\nindex 0f0107c80dd2..f9de632e38cd 100644\n--- a/net/netfilter/ipvs/ip_vs_proto_udp.c\n+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c\n@@ -24,7 +24,8 @@\n #include <net/ip6_checksum.h>\n \n static int\n-udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp);\n+udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,\n+\t unsigned int udphoff);\n \n static int\n udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb,\n@@ -154,7 +155,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \t\tint ret;\n \n \t\t/* Some checks before mangling */\n-\t\tif (!udp_csum_check(cp->af, skb, pp))\n+\t\tif (!udp_csum_check(cp->af, skb, pp, udphoff))\n \t\t\treturn 0;\n \n \t\t/*\n@@ -237,7 +238,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \t\tint ret;\n \n \t\t/* Some checks before mangling */\n-\t\tif (!udp_csum_check(cp->af, skb, pp))\n+\t\tif (!udp_csum_check(cp->af, skb, pp, udphoff))\n \t\t\treturn 0;\n \n \t\t/*\n@@ -296,17 +297,10 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,\n \n \n static int\n-udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)\n+udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,\n+\t unsigned int udphoff)\n {\n \tstruct udphdr _udph, *uh;\n-\tunsigned int udphoff;\n-\n-#ifdef CONFIG_IP_VS_IPV6\n-\tif (af == AF_INET6)\n-\t\tudphoff = sizeof(struct ipv6hdr);\n-\telse\n-#endif\n-\t\tudphoff = ip_hdrlen(skb);\n \n \tuh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph);\n \tif (uh == NULL)\n@@ -324,7 +318,7 @@ udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp)\n \t\t\t\tif (csum_ipv6_magic(&ipv6_hdr(skb)->saddr,\n \t\t\t\t\t\t &ipv6_hdr(skb)->daddr,\n \t\t\t\t\t\t skb->len - udphoff,\n-\t\t\t\t\t\t ipv6_hdr(skb)->nexthdr,\n+\t\t\t\t\t\t IPPROTO_UDP,\n \t\t\t\t\t\t skb->csum)) {\n \t\t\t\t\tIP_VS_DBG_RL_PKT(0, af, pp, skb, 0,\n \t\t\t\t\t\t\t \"Failed checksum for\");\n", "prefixes": [ "nf", "1/2" ] }