netdev - [PATCH] act_nat: fix the wrong checksum when addr isn't in old

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 29 May 2010 18:41:51 +0800
From:	Changli Gao <xiaosuo@...il.com>
To:	Jamal Hadi Salim <hadi@...erus.ca>
Cc:	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, Changli Gao <xiaosuo@...il.com>
Subject: [PATCH] act_nat: fix the wrong checksum when addr isn't in old_addr/mask

fix the wrong checksum when addr isn't in old_addr/mask

When addr isn't in old_addr/mask we don't do SNAT or DNAT, and we should not
update the checksum too.

Signed-off-by: Changli Gao <xiaosuo@...il.com>
----
 net/sched/act_nat.c |   32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index d885ba3..f9b12a9 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -142,24 +142,25 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 	else
 		addr = iph->daddr;
 
-	if (!((old_addr ^ addr) & mask)) {
-		if (skb_cloned(skb) &&
-		    !skb_clone_writable(skb, sizeof(*iph)) &&
-		    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
-			goto drop;
+	if ((old_addr ^ addr) & mask)
+		goto out;
 
-		new_addr &= mask;
-		new_addr |= addr & ~mask;
+	if (skb_cloned(skb) &&
+	    !skb_clone_writable(skb, sizeof(*iph)) &&
+	    pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+		goto drop;
 
-		/* Rewrite IP header */
-		iph = ip_hdr(skb);
-		if (egress)
-			iph->saddr = new_addr;
-		else
-			iph->daddr = new_addr;
+	new_addr &= mask;
+	new_addr |= addr & ~mask;
 
-		csum_replace4(&iph->check, addr, new_addr);
-	}
+	/* Rewrite IP header */
+	iph = ip_hdr(skb);
+	if (egress)
+		iph->saddr = new_addr;
+	else
+		iph->daddr = new_addr;
+
+	csum_replace4(&iph->check, addr, new_addr);
 
 	ihl = iph->ihl * 4;
 
@@ -247,6 +248,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
 		break;
 	}
 
+out:
 	return action;
 
 drop:
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html