Files
linux/include/net
Julian Anastasov e876b75b90 ipvs: fix the checksum validations
ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
packets from clients. In fact, as for TCP/UDP we should
validate the checksum for ICMP packets only when we
mangle the packets on MASQ or on reply for tunnel.

Also, Sashiko points out that handle_response_icmp() being
common for IPv4 and IPv6 is missing the pseudo-header
calculation while validating ICMPv6 messages from real
servers which is a problem if checksum is not validated
by the hardware.

Fix the problems by creating ip_vs_checksum_common_check()
helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.
Rely on the nf_checksum() for validating the ICMP messages
but use it also for TCP and UDP.

Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.

IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum
validation on LOCAL_OUT (local clients or local real
servers) and on FORWARD (traffic from servers on LAN).
Do it only on LOCAL_IN, in case nf_checksum() is not
called on PRE_ROUTING.

Also, ip_vs_checksum_complete() can be marked static.

Fixes: 2a3b791e6e ("IPVS: Add/adjust Netfilter hook functions and helpers for v6")
Link: https://sashiko.dev/#/patchset/20260708180315.77413-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-07-23 18:04:40 +02:00
..
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2026-05-21 13:04:42 +02:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2025-08-26 17:34:31 -07:00
2026-01-21 19:28:32 -08:00
2024-05-07 01:35:55 +02:00
2024-08-26 09:37:23 -07:00
2026-07-23 18:04:40 +02:00
2024-12-06 17:43:08 -08:00
2025-09-18 12:32:06 +02:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2025-04-11 18:58:10 -07:00
2025-07-04 09:32:35 +02:00
2024-05-30 18:29:38 -07:00
2025-09-08 18:06:21 -07:00
2025-07-11 11:00:57 -07:00
2026-03-13 18:57:44 -07:00
2026-04-06 18:43:51 -07:00
2026-03-16 19:28:21 -07:00