Re: [PATCH nf v3 0/3] ipvs: csum validations and data offsets

	Hello,

On Wed, 22 Jul 2026, Julian Anastasov wrote:

> 	This patchset contains fixes for the checksum
> validations for ICMPv6 and switches TCP, UDP and ICMP to
> use nf_checksum for LOCAL_IN.
> 
> 	It also corrects offsets to be based on skb->data and to
> respect the network offset.
> 
>         Finally, it prevents to read/write ICMP payload for
> non-first embedded fragments wrongly assuming the TCP/UDP/SCTP
> ports are present there.
> 
> Changes:
> 
> v2->v3:
> * patch 2: add __maybe_unused to coff and outer_proto to silence
>   the compiler warnings when IPVS debugging is not enabled, reported
>   by the kernel test robot <[email protected]>:
>   https://lore.kernel.org/oe-kbuild-all/[email protected]/
> * add patch 3
> 
> v1->v2:
> * patch 1: switch to using nf_checksum, validate only at LOCAL_IN and
>   for MASQ
> * add patch 2
> 
> Julian Anastasov (3):
>   ipvs: fix the checksum validations
>   ipvs: fix places with wrong packet offsets
>   ipvs: do not mangle ICMP replies for non-first fragments

	Comments about the Sashiko review:

https://sashiko.dev/#/patchset/20260722101517.36313-1-ja%40ssi.bg

	About patch 2 for ip_vs_in_icmp() and the offset for wlen:

- there is a 'offset = ciph.len;' statement just after
ip_vs_fill_iph_skb_icmp(AF_INET, skb, offset, !tunnel, &ciph)

	which accounts the embedded IP header. So, if I don't
miss something, Sashiko is wrong here. Not sure if the confusion
comes from the fact that patch 3 removes this statement and
the wlen argument

	About patch 3 and the double-fetch of ciph->ihl:

- this is a pre-existing issue, unless there is no new version
for patch 2, I'll create a followup patch to fix it as it is
done in ip_vs_nat_icmp_v6 in patch 2.

>  include/net/ip_vs.h                   |  48 +++++--
>  net/netfilter/ipvs/ip_vs_app.c        |   4 +-
>  net/netfilter/ipvs/ip_vs_core.c       | 180 +++++++++++++-------------
>  net/netfilter/ipvs/ip_vs_proto_sctp.c |  19 +--
>  net/netfilter/ipvs/ip_vs_proto_tcp.c  |  48 ++-----
>  net/netfilter/ipvs/ip_vs_proto_udp.c  |  54 ++------
>  net/netfilter/ipvs/ip_vs_xmit.c       |  42 ++++--
>  7 files changed, 193 insertions(+), 202 deletions(-)
> 
> -- 
> 2.55.0

Regards

--
Julian Anastasov <[email protected]>