| Message ID | 20220128113821.7009-1-fw@strlen.de |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | [4.19.y] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments | expand |
On Fri, Jan 28, 2022 at 12:38:21PM +0100, Florian Westphal wrote: > From: Pablo Neira Ayuso <pablo@netfilter.org> > > commit 4e1860a3863707e8177329c006d10f9e37e097a8 upstream. > > IP fragments do not come with the transport header, hence skip bogus > layer 4 checksum updates. > > Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") > Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > Signed-off-by: Florian Westphal <fw@strlen.de> > --- > This is already in the 5.y branches but 4.19 needs a minor > tweak as ->fragoff member resides in xt sub-struct. Thanks for taking care of this -stable submission. > net/netfilter/nft_payload.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c > index b1a9f330a51f..fd87216bc0a9 100644 > --- a/net/netfilter/nft_payload.c > +++ b/net/netfilter/nft_payload.c > @@ -194,6 +194,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt, > struct sk_buff *skb, > unsigned int *l4csum_offset) > { > + if (pkt->xt.fragoff) > + return -1; > + > switch (pkt->tprot) { > case IPPROTO_TCP: > *l4csum_offset = offsetof(struct tcphdr, check); > -- > 2.34.1 >
On Fri, Jan 28, 2022 at 12:38:21PM +0100, Florian Westphal wrote: > From: Pablo Neira Ayuso <pablo@netfilter.org> > > commit 4e1860a3863707e8177329c006d10f9e37e097a8 upstream. > > IP fragments do not come with the transport header, hence skip bogus > layer 4 checksum updates. > > Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") > Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > Signed-off-by: Florian Westphal <fw@strlen.de> > --- > This is already in the 5.y branches but 4.19 needs a minor > tweak as ->fragoff member resides in xt sub-struct. I don't see this commit in the 5.10 or 5.4 branches, am I missing something? confused, greg k-h
Greg KH <gregkh@linuxfoundation.org> wrote: > On Fri, Jan 28, 2022 at 12:38:21PM +0100, Florian Westphal wrote: > > From: Pablo Neira Ayuso <pablo@netfilter.org> > > > > commit 4e1860a3863707e8177329c006d10f9e37e097a8 upstream. > > > > IP fragments do not come with the transport header, hence skip bogus > > layer 4 checksum updates. > > > > Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") > > Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org> > > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > > Signed-off-by: Florian Westphal <fw@strlen.de> > > --- > > This is already in the 5.y branches but 4.19 needs a minor > > tweak as ->fragoff member resides in xt sub-struct. > > I don't see this commit in the 5.10 or 5.4 branches, am I missing > something? Oh, indeed. Can you place this patch in 5.4 and 5.10 too? Releases >= v5.14 should be covered given upstream commit works as-is on those. Thanks, Florian
On Sat, Jan 29, 2022 at 01:04:44PM +0100, Florian Westphal wrote: > Greg KH <gregkh@linuxfoundation.org> wrote: > > On Fri, Jan 28, 2022 at 12:38:21PM +0100, Florian Westphal wrote: > > > From: Pablo Neira Ayuso <pablo@netfilter.org> > > > > > > commit 4e1860a3863707e8177329c006d10f9e37e097a8 upstream. > > > > > > IP fragments do not come with the transport header, hence skip bogus > > > layer 4 checksum updates. > > > > > > Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") > > > Reported-and-tested-by: Steffen Weinreich <steve@weinreich.org> > > > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > > > Signed-off-by: Florian Westphal <fw@strlen.de> > > > --- > > > This is already in the 5.y branches but 4.19 needs a minor > > > tweak as ->fragoff member resides in xt sub-struct. > > > > I don't see this commit in the 5.10 or 5.4 branches, am I missing > > something? > > Oh, indeed. Can you place this patch in 5.4 and 5.10 too? Now done, and it was needed for 4.14.y, so I added it there too, thanks! greg k-h
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c index b1a9f330a51f..fd87216bc0a9 100644 --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -194,6 +194,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt, struct sk_buff *skb, unsigned int *l4csum_offset) { + if (pkt->xt.fragoff) + return -1; + switch (pkt->tprot) { case IPPROTO_TCP: *l4csum_offset = offsetof(struct tcphdr, check);