netdev - [PATCH] ipv6: ip6mr: Recalc UDP checksum before forwarding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1513164048-21368-1-git-send-email-redmcg@redmandi.dyndns.org>
Date:   Wed, 13 Dec 2017 22:20:48 +1100
From:   Brendan McGrath <redmcg@...mandi.dyndns.org>
To:     "David S . Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     Brendan McGrath <redmcg@...mandi.dyndns.org>
Subject: [PATCH] ipv6: ip6mr: Recalc UDP checksum before forwarding

Currently, when forwarding from a Virtual Interface to a Physical
Interface, ip_summed is set to a value of CHECKSUM_UNNECESSARY and
the UDP checksum has not been calculated.

When the packet is then forwarded by a Multicast Router, the checksum
value is left as is and therefore rejected by the receiving
machine(s).

This patch ensures the checksum is recalculated before forwarding.

Signed-off-by: Brendan McGrath <redmcg@...mandi.dyndns.org>
---

It's a bit ugly putting UDP specific code in this spot - but I'm not
aware of any other protocols that are:
a) multicast;
b) forwarded; and
c) checksummed

 net/ipv6/ip6mr.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 890f9bda..ee4370a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2077,6 +2077,13 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
 	ipv6h = ipv6_hdr(skb);
 	ipv6h->hop_limit--;
 
+	if (ipv6h->nexthdr == NEXTHDR_UDP &&
+					skb->ip_summed != CHECKSUM_PARTIAL) {
+		struct udphdr *uh = udp_hdr(skb);
+		udp6_set_csum(false, skb, &ipv6_hdr(skb)->saddr,
+					&ipv6_hdr(skb)->daddr, ntohs(uh->len));
+	}
+
 	IP6CB(skb)->flags |= IP6SKB_FORWARDED;
 
 	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
-- 
2.7.4