Re: [PATCH net 07/12] netfilter: nft_payload: restrict checksum offsets to known values

Jakub Kicinski [off-list ref] wrote:

[Severity: High]
Should nft_payload_csum_th_write_ok() also handle IPPROTO_ICMP?  There is
no arm for it, and neither IPPROTO_ICMP nor struct icmphdr appear anywhere
in nft_payload.c (linux/icmp.h is not included), so pkt->tprot ==
IPPROTO_ICMP falls out of the switch and returns false.

Sigh.

Two things that may be worth considering: adding

	case IPPROTO_ICMP:
		return priv->csum_offset == offsetof(struct icmphdr, checksum);

to nft_payload_csum_th_write_ok(), and making the run time refusal set
NFT_BREAK rather than silently skipping the checksum update, so load time
and run time agree.

Sigh.