Re: [PATCH net 07/12] netfilter: nft_payload: restrict checksum offsets to known values

Jakub Kicinski <[email protected]> wrote:
> [Severity: High]
> Should nft_payload_csum_th_write_ok() also handle IPPROTO_ICMP?  There is
> no arm for it, and neither IPPROTO_ICMP nor struct icmphdr appear anywhere
> in nft_payload.c (linux/icmp.h is not included), so pkt->tprot ==
> IPPROTO_ICMP falls out of the switch and returns false.

Sigh.

> Two things that may be worth considering: adding
> 
> 	case IPPROTO_ICMP:
> 		return priv->csum_offset == offsetof(struct icmphdr, checksum);
> 
> to nft_payload_csum_th_write_ok(), and making the run time refusal set
> NFT_BREAK rather than silently skipping the checksum update, so load time
> and run time agree.

Sigh.