Re: [PATCH nf] ipvs: fix the checksum validations

	Hello,

On Thu, 9 Jul 2026, Florian Westphal wrote:

> Julian Anastasov <[email protected]> wrote:
> > TCP/UDP checksum validation for CHECKSUM_COMPLETE is broken
> > before the git history.
> > 
> > Expecting skb->csum to cover data starting from the protocol
> > header is wrong. As IPVS works at the IP layer, the csum for
> > the IP header is not subtracted yet.
> > 
> > ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
> > packets from clients.
> > 
> > Also, Sashiko points out that handle_response_icmp() being
> > common for IPv4 and IPv6 is missing the pseudo-header
> > calculation while validating ICMPv6 messages from real
> > servers which is a problem if checksum is not validated
> > by the hardware.
> > 
> > Fix the problems by creating ip_vs_checksum_common_check()
> > helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.
> > 
> > Also, ip_vs_checksum_complete() can be marked static.
> 
> Just FYI, I'll ignore the sashiko comment wrt.
> 'hardcoded sizeof(struct ipv6hdr)' as thats resolved by your
> earlier patch, so I plan to include this in tomorrows batch.

	Yep, both patches solve the reported problems there...

Regards

--
Julian Anastasov <[email protected]>