]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ipvs: return the csum validation for forward hook
authorJulian Anastasov <ja@ssi.bg>
Thu, 30 Jul 2026 18:35:06 +0000 (21:35 +0300)
committerPablo Neira Ayuso <pablo@netfilter.org>
Fri, 31 Jul 2026 13:58:30 +0000 (15:58 +0200)
commit99609cb0aa789c8d071050ce8579989551882cc6
tree69cfeec3bb84e869106da19ac5f7853191d0e21b
parent646922a0379496154e8c8faca4f8e2fd9100cacc
ipvs: return the csum validation for forward hook

Sashiko notes that playing games with the skb dst and rt
flags instead of providing hooknum is not a good idea
when validating the checksums.

Also, skipping checksum validation for FORWARD packets
risk silent data corruption, even if the only user is
the FTP-CMD packets coming from the real server.

Sashiko also noticed that by using common checksum
helper in the previous commit we actually fixed old bug
where the TCP/UDP checksum for IPv6 on CHECKSUM_COMPLETE
was not validated correctly.

Fixes: e876b75b9020 ("ipvs: fix the checksum validations")
Link: https://sashiko.dev/#/patchset/20260722211420.153933-1-pablo%40netfilter.org
Link: https://sashiko.dev/#/patchset/20260727185024.67534-1-ja%40ssi.bg
Link: https://sashiko.dev/#/patchset/20260728202520.59179-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/ip_vs.h
net/netfilter/ipvs/ip_vs_proto_sctp.c