[PATCH net] netfilter: set skb transport_header before calling sctp_compute_cksum

[Xin Long]

sctp_hdr(skb) only works when skb->transport_header is set
properly.

But in the path of nf_conntrack_in:

  sctp_packet() -> sctp_error() -> sctp_compute_cksum().

skb->transport_header is not guaranteed to be right value
for sctp. It will cause to fail to check the checksum for
sctp packets.

So fix it by setting skb transport_header before calling
sctp_compute_cksum().

Fixes: e6d8b64b34aa ("net: sctp: fix and consolidate SCTP checksumming code")
Reported-by: Li Shuang <shu...@redhat.com>
Signed-off-by: Xin Long <lucien....@gmail.com>
Acked-by: Neil Horman <nhor...@tuxdriver.com>
---
 net/netfilter/nf_conntrack_proto_sctp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_conntrack_proto_sctp.c 
b/net/netfilter/nf_conntrack_proto_sctp.c
index d53e3e7..6b53cd2 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -343,7 +343,9 @@ static bool sctp_error(struct sk_buff *skb,
                        logmsg = "nf_ct_sctp: failed to read header ";
                        goto out_invalid;
                }
-               sh = (const struct sctphdr *)(skb->data + dataoff);
+               /* sctp_compute_cksum() depends on correct transport header */
+               skb_set_transport_header(skb, dataoff);
+               sh = sctp_hdr(skb);
                if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                        logmsg = "nf_ct_sctp: bad CRC ";
                        goto out_invalid;
-- 
2.1.0