This is technically correct. There are caveats for IPv6 (namely,
zero is not allowed and a receiver is expected to drop packets with
such a checksum, RFC8200 8.1). If we don't drop, but also do not
modify the field, we're not violating this rule. On transmission,
the 0x0000->0xffff still needs to happen, so this code is correct
for IPv4 and IPv6.
I have not actually tested this, just stared at the code :-) - and we
have +2 from Razvan (thanks).
I'm applying this to release/2.7, as it's clearly a bug fix. I am not
backporting to 2.6, 2.5, 2.4 etc as it's not a security issue, and the
first report we ever had was in May this year - so it seems to hit
infrequently enough (plus --client-nat is an edge case anyway).
Your patch has been applied to the master and release/2.7 branch (bugfix).
commit c797db6225755e6d7144d433ed55d3992d8ff141 (master)
commit e1d0005ec1a15fffbebc14fcf42ad36332e3a36a (release/2.7)
Author: Antonio Quartulli
Date: Fri Aug 21 20:24:34 2026 +0200
clinat: do not adjust UDP checksum if zero
Signed-off-by: Antonio Quartulli <[email protected]>
Acked-by: Razvan Cojocaru <[email protected]>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1681
Message-Id: <[email protected]>
URL:
https://www.mail-archive.com/[email protected]/msg38581.html
Signed-off-by: Gert Doering <[email protected]>
--
kind regards,
Gert Doering
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
