In the conntrack hook it may not always be the case that: skb_network_header(skb) == skb->data, i.e. skb_network_offset(skb) is zero.
This is problematic when L4 function nf_conntrack_handle_packet() is accessing L3 data. This function uses thoff and ip_hdr() to finds it's data. But it also calculates the checksum. nf_checksum() and nf_checksum_partial() both use lower skb-checksum functions that are based on using skb->data. Adjust for skb_network_offset(skb), so that the checksum is calculated correctly. Signed-off-by: Eric Woudstra <[email protected]> --- net/netfilter/utils.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/net/netfilter/utils.c b/net/netfilter/utils.c index 008419db815a..7b33fe63c5fa 100644 --- a/net/netfilter/utils.c +++ b/net/netfilter/utils.c @@ -124,16 +124,25 @@ __sum16 nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, u8 protocol, unsigned short family) { + unsigned int nhpull = skb_network_offset(skb); __sum16 csum = 0; + if (WARN_ON(!skb_pointer_if_linear(skb, nhpull, 0))) + return 0; + + /* pull/push because the lower csum functions assume that + * skb_network_offset(skb) is zero. + */ + __skb_pull(skb, nhpull); switch (family) { case AF_INET: - csum = nf_ip_checksum(skb, hook, dataoff, protocol); + csum = nf_ip_checksum(skb, hook, dataoff - nhpull, protocol); break; case AF_INET6: - csum = nf_ip6_checksum(skb, hook, dataoff, protocol); + csum = nf_ip6_checksum(skb, hook, dataoff - nhpull, protocol); break; } + __skb_push(skb, nhpull); return csum; } @@ -143,18 +152,25 @@ __sum16 nf_checksum_partial(struct sk_buff *skb, unsigned int hook, unsigned int dataoff, unsigned int len, u8 protocol, unsigned short family) { + unsigned int nhpull = skb_network_offset(skb); __sum16 csum = 0; + if (WARN_ON(!skb_pointer_if_linear(skb, nhpull, 0))) + return 0; + + /* See nf_checksum() */ + __skb_pull(skb, nhpull); switch (family) { case AF_INET: - csum = nf_ip_checksum_partial(skb, hook, dataoff, len, - protocol); + csum = nf_ip_checksum_partial(skb, hook, dataoff - nhpull, + len, protocol); break; case AF_INET6: - csum = nf_ip6_checksum_partial(skb, hook, dataoff, len, - protocol); + csum = nf_ip6_checksum_partial(skb, hook, dataoff - nhpull, + len, protocol); break; } + __skb_push(skb, nhpull); return csum; } -- 2.50.0
