[Openvpn-devel] [PATCH applied] Re: clinat: do not adjust UDP checksum if zero

This is technically correct.  There are caveats for IPv6 (namely, 
zero is not allowed and a receiver is expected to drop packets with
such a checksum, RFC8200 8.1).  If we don't drop, but also do not
modify the field, we're not violating this rule.  On transmission,
the 0x0000->0xffff still needs to happen, so this code is correct
for IPv4 and IPv6.

I have not actually tested this, just stared at the code :-) - and we
have +2 from Razvan (thanks).

I'm applying this to release/2.7, as it's clearly a bug fix.  I am not
backporting to 2.6, 2.5, 2.4 etc as it's not a security issue, and the
first report we ever had was in May this year - so it seems to hit
infrequently enough (plus --client-nat is an edge case anyway).

Your patch has been applied to the master and release/2.7 branch (bugfix).

commit c797db6225755e6d7144d433ed55d3992d8ff141 (master)
commit e1d0005ec1a15fffbebc14fcf42ad36332e3a36a (release/2.7)
Author: Antonio Quartulli
Date:   Fri Aug 21 20:24:34 2026 +0200

     clinat: do not adjust UDP checksum if zero

     Signed-off-by: Antonio Quartulli <[email protected]>
     Acked-by: Razvan Cojocaru <[email protected]>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1681
     Message-Id: <[email protected]>
     URL: https://www.mail-archive.com/[email protected]/msg38581.html
     Signed-off-by: Gert Doering <[email protected]>


--
kind regards,

Gert Doering



_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel