netfilter: nft_payload: do not update layer 4 checksum when mangling …

…fragments IP fragments do not come with the transport header, hence skip bogus layer 4 checksum updates. Fixes: 1814096 ("netfilter: nft_payload: layer 4 checksum adjustment for pseudoheader fields") Reported-and-tested-by: Steffen Weinreich <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
pop-os · Jan 6, 2022 · 4e1860a · 4e1860a
1 parent 1585f59
commit 4e1860a
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
@@ -546,6 +546,9 @@ static int nft_payload_l4csum_offset(const struct nft_pktinfo *pkt,
 				     struct sk_buff *skb,
 				     unsigned int *l4csum_offset)
 {
+	if (pkt->fragoff)
+		return -1;
+
 	switch (pkt->tprot) {
 	case IPPROTO_TCP:
 		*l4csum_offset = offsetof(struct tcphdr, check);