Commit e9cba694 authored Aug 01, 2017 by Yossi Kuperman Committed by Steffen Klassert Aug 02, 2017

xfrm6: Fix CHECKSUM_COMPLETE after IPv6 header push



xfrm6_transport_finish rebuilds the IPv6 header based on the
original one and pushes it back without fixing skb->csum.
Therefore, CHECKSUM_COMPLETE is no longer valid and the packet
gets dropped.

Fix skb->csum by calling skb_postpush_rcsum.

Note: A valid IPv4 header has checksum 0, unlike IPv6. Thus,
the change is not needed in the sibling xfrm4_transport_finish
function.

Signed-off-by: Yossi Kuperman <yossiku@mellanox.com>
Signed-off-by: Ilan Tayari <ilant@mellanox.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent e51a6472

net/ipv6/xfrm6_input.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -34,6 +34,7 @@ EXPORT_SYMBOL(xfrm6_rcv_spi);
		int xfrm6_transport_finish(struct sk_buff *skb, int async)
		{
		struct xfrm_offload *xo = xfrm_offload(skb);
		int nhlen = skb->data - skb_network_header(skb);

		skb_network_header(skb)[IP6CB(skb)->nhoff] =
		XFRM_MODE_SKB_CB(skb)->protocol;
		@@ -43,8 +44,9 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
		return 1;
		#endif

		__skb_push(skb, skb->data - skb_network_header(skb));
		__skb_push(skb, nhlen);
		ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
		skb_postpush_rcsum(skb, skb_network_header(skb), nhlen);

		if (xo && (xo->flags & XFRM_GRO)) {
		skb_mac_header_rebuild(skb);

Admin message