netlink_linearize: fix IPv6 layer 4 checksum mangling

In IPv6 there is no checksum field. We always have to trigger layer 4
checksum mangling if any of the layer 3 pseudoheader fields are updated.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 4a0001a4ce177a36a1ff68a2a7ecb89350e3c90f..0915038fecaef8ed729266046eaf4b1005c7fcee 100644 (file)
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -806,12 +806,11 @@ static void netlink_gen_payload_stmt(struct netlink_linearize_ctx *ctx,
                                   NFT_PAYLOAD_CSUM_INET);
                nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_CSUM_OFFSET,
                                   csum_off / BITS_PER_BYTE);
-
-               if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
-                   payload_needs_l4csum_update_pseudohdr(expr, desc))
-                       nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
-                                          NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
        }
+       if (expr->payload.base == PROTO_BASE_NETWORK_HDR &&
+           payload_needs_l4csum_update_pseudohdr(expr, desc))
+               nftnl_expr_set_u32(nle, NFTNL_EXPR_PAYLOAD_FLAGS,
+                                  NFT_PAYLOAD_L4CSUM_PSEUDOHDR);
 
        nftnl_rule_add_expr(ctx->nlr, nle);
 }