[PATCH nf v3 0/2] ipvs: csum validations, part 2

	Hello,

        This patchset contains more fixes after the
previous batch of fixes for checksum validations.

        The first patch avoids reading the IPv4 ihl field
multiple times to prevent local attacker to cause
out-of-bounds write in ip_vs_nat_icmp.

        The second patch returns the checksum validations
which can be needed for the FORWARD hook.

Changes:
v2->v3:
* patch 2: rely on nf_checksum for marking the csum as
  validated

v1->v2:
* patch 2: prefer our common helper for csum validation because
  the old TCP/UDP checksum validation for IPv6 on CHECKSUM_COMPLETE
  was wrong

v1:
* patch 2: use per-proto checksum validations

Julian Anastasov (2):
  ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
  ipvs: return the csum validation for forward hook

 include/net/ip_vs.h                   | 21 +++------
 net/netfilter/ipvs/ip_vs_core.c       | 67 ++++++++++++++-------------
 net/netfilter/ipvs/ip_vs_proto_sctp.c |  2 +-
 net/netfilter/ipvs/ip_vs_xmit.c       |  2 +-
 4 files changed, 42 insertions(+), 50 deletions(-)

-- 
2.55.0