@@ -806,12 +806,11 @@ static void netlink_gen_payload_stmt(struct netlink_linearize_ctx *ctx,
NFT_PAYLOAD_CSUM_INET);
nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_CSUM_OFFSET,
csum_off / BITS_PER_BYTE);
-
- if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
- payload_needs_l4csum_update_pseudohdr(expr, desc))
- nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
- NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
}
+ if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
+ payload_needs_l4csum_update_pseudohdr(expr, desc))
+ nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
+ NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
nftnl_rule_add_expr(ctx->nlr, nle);
}
In IPv6 there is no checksum field, so we have to trigger layer 4 checksum mangling when layer 3 pseudoheader fields are updated inconditionally. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- Kernel patch is following up soon for nf. src/netlink_linearize.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)