|
Hello,
On Thu, 9 Jul 2026, Florian Westphal wrote:
> Julian Anastasov <ja@xxxxxx> wrote:
> > TCP/UDP checksum validation for CHECKSUM_COMPLETE is broken
> > before the git history.
> >
> > Expecting skb->csum to cover data starting from the protocol
> > header is wrong. As IPVS works at the IP layer, the csum for
> > the IP header is not subtracted yet.
> >
> > ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
> > packets from clients.
> >
> > Also, Sashiko points out that handle_response_icmp() being
> > common for IPv4 and IPv6 is missing the pseudo-header
> > calculation while validating ICMPv6 messages from real
> > servers which is a problem if checksum is not validated
> > by the hardware.
> >
> > Fix the problems by creating ip_vs_checksum_common_check()
> > helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.
> >
> > Also, ip_vs_checksum_complete() can be marked static.
>
> Just FYI, I'll ignore the sashiko comment wrt.
> 'hardcoded sizeof(struct ipv6hdr)' as thats resolved by your
> earlier patch, so I plan to include this in tomorrows batch.
Yep, both patches solve the reported problems there...
Regards
--
Julian Anastasov <ja@xxxxxx>
|
