Re: [PATCH v3] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets

[lvjunyu]

Thank you for the review.

> [High] The fix covers only one caller, __udp_manip_pkt() in
> net/netfilter/nf_nat_proto.c.

The scope is intentional.  The LCO state this patch fixes is specific
to the UDP encapsulation path: udp_set_csum() writes a complete
(folded, complemented) checksum into uh->check while leaving
csum_start pointing at the inner transport header.  This split state
arises only for locally generated VXLAN/Geneve outer headers that
traverse the conntrack NAT OUTPUT path.

The flowtable software fast path (nf_flow_nat_ip_udp and friends) is
not reached by these packets.  VXLAN outer headers are locally
generated via vxlan_xmit() -> udp_set_csum() and enter the OUTPUT
chain.  The flowtable hook (nf_flow_offload_ip_hook) is registered
at NF_INET_FORWARD, which locally generated packets do not traverse.
Even after the conntrack entry is established, subsequent outer
packets still follow OUTPUT -> POSTROUTING -> __udp_manip_pkt(),
because flowtable offload applies to forwarded flows, not locally
generated ones.

For the sibling call sites:

- tcp_manip_pkt() and icmpv6_manip_pkt(): the offload target is the
  TCP/ICMPv6 header itself (csum_start + csum_offset == &hdr->check),
  so the LCO condition does not arise.  The seed path is correct for
  these protocols.

- Headers embedded in ICMP errors
  (nf_nat_icmp_reply_translation): byte copies in the ICMP payload,
  not live checksum-offloaded data; ip_summed is typically NONE or
  COMPLETE.

- tcf_nat_act() and IPVS: these paths handle LCO-state encapsulated
  UDP packets in theory, but the practical deployment scenario
  (locally generated VXLAN + MASQUERADE --random-fully) is specific
  to the conntrack NAT OUTPUT path.

A helper-level fix in inet_proto_csum_replace4/16/_by_diff() would
cover all ~45 call sites at once and is architecturally preferable.
However, modifying core checksum helpers that are shared by TCP, UDP,
ICMPv6, eBPF, OVS, GSO offload, and ILA requires a separate, more
thorough analysis and test cycle.  This patch is scoped to the UDP
path where the bug is observed and verified; the helper-level
approach is planned as a follow-up.

--
lvjunyu