|
Hello,
On Wed, 22 Jul 2026, Julian Anastasov wrote:
> This patchset contains fixes for the checksum
> validations for ICMPv6 and switches TCP, UDP and ICMP to
> use nf_checksum for LOCAL_IN.
>
> It also corrects offsets to be based on skb->data and to
> respect the network offset.
>
> Finally, it prevents to read/write ICMP payload for
> non-first embedded fragments wrongly assuming the TCP/UDP/SCTP
> ports are present there.
>
> Changes:
>
> v2->v3:
> * patch 2: add __maybe_unused to coff and outer_proto to silence
> the compiler warnings when IPVS debugging is not enabled, reported
> by the kernel test robot <lkp@xxxxxxxxx>:
> https://lore.kernel.org/oe-kbuild-all/202607210623.du5PqolJ-lkp@xxxxxxxxx/
> * add patch 3
>
> v1->v2:
> * patch 1: switch to using nf_checksum, validate only at LOCAL_IN and
> for MASQ
> * add patch 2
>
> Julian Anastasov (3):
> ipvs: fix the checksum validations
> ipvs: fix places with wrong packet offsets
> ipvs: do not mangle ICMP replies for non-first fragments
Comments about the Sashiko review:
https://sashiko.dev/#/patchset/20260722101517.36313-1-ja%40ssi.bg
About patch 2 for ip_vs_in_icmp() and the offset for wlen:
- there is a 'offset = ciph.len;' statement just after
ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !tunnel, &ciph)
which accounts the embedded IP header. So, if I don't
miss something, Sashiko is wrong here. Not sure if the confusion
comes from the fact that patch 3 removes this statement and
the wlen argument
About patch 3 and the double-fetch of ciph->ihl:
- this is a pre-existing issue, unless there is no new version
for patch 2, I'll create a followup patch to fix it as it is
done in ip_vs_nat_icmp_v6 in patch 2.
> include/net/ip_vs.h | 48 +++++--
> net/netfilter/ipvs/ip_vs_app.c | 4 +-
> net/netfilter/ipvs/ip_vs_core.c | 180 +++++++++++++-------------
> net/netfilter/ipvs/ip_vs_proto_sctp.c | 19 +--
> net/netfilter/ipvs/ip_vs_proto_tcp.c | 48 ++-----
> net/netfilter/ipvs/ip_vs_proto_udp.c | 54 ++------
> net/netfilter/ipvs/ip_vs_xmit.c | 42 ++++--
> 7 files changed, 193 insertions(+), 202 deletions(-)
>
> --
> 2.55.0
Regards
--
Julian Anastasov <ja@xxxxxx>
|
