netdev - RE: [PATCH] [netfilter]: Fix skb->csum calculation when netfilter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <1571864162-9097-1-git-send-email-pchaudhary@linkedin.com>
Date:   Wed, 23 Oct 2019 13:56:02 -0700
From:   Praveen Chaudhary <praveen5582@...il.com>
To:     fw@...len.de
Cc:     astracner@...kedin.com, davem@...emloft.net, kadlec@...filter.org,
        linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        pablo@...filter.org, praveen5582@...il.com, zxu@...kedin.com
Subject: RE: [PATCH] [netfilter]: Fix skb->csum calculation when netfilter

Hi Florian 

Thanks for the review,

inet_proto_csum_replace16 is called from many places, whereas this fix is applicable only for nf_nat_ipv6_csum_update, where we need to update skb->csum for ipv6 src/dst address change. 
Also my point is, inet_proto_csum_replace16 is updating skb->csum for change in udp header checksum field, but that is not complete. So, I added a new function. Basically, I used a safe apprioach to fix it, without impacting other cases. Let me know other options,  I am open to suggestions.

More importantly, I hope this is clear that the current code does not update skb->csum completely. Which is a bug. Thanks again.