Re: IP Masquarading is broken after 2.1.7?

Matt Cross (mcross@sw.stratus.com)
Mon, 16 Dec 1996 09:27:52 -0500

Yes, there is in fact a problem in IP masquerading that was introduced
in 2.1.8. The checksums on outgoing TCP packets are not generated
properly. I posted a fix last week against 2.1.14. I have not had a
chance to move up to 2.1.15 and upgrade the fix to that, but it
shouldn't be too hard to apply it to 2.1.15 as well. Since it's so
short, I'll include it here again:

--- linux-2.1.14/net/ipv4/ip_masq.c Wed Dec 11 21:52:38 1996
+++ linux/net/ipv4/ip_masq.c Wed Dec 11 19:45:07 1996
@@ -566,8 +566,10 @@
else timeout = ip_masq_expire->tcp_timeout;

skb->csum = csum_partial((void *)(th + 1), size - sizeof(*th), 0);
- tcp_v4_check(th, size, iph->saddr, iph->daddr,
- skb->csum);
+ th->check = 0;
+ th->check = tcp_v4_check(th, size, iph->saddr, iph->daddr,
+ csum_partial ((char *)th, sizeof(*th),
+ skb->csum));
}
ip_masq_set_expire(ms, timeout);
ip_send_check(iph);
@@ -899,9 +901,11 @@
len - sizeof(struct tcphdr), 0);
th = (struct tcphdr *) portptr;
th->check = 0;
-
- tcp_v4_check(th, len, iph->saddr, iph->daddr,
- skb->csum);
+ th->check = tcp_v4_check(th, len, iph->saddr,
+ iph->daddr,
+ csum_partial((char *)th,
+ sizeof(*th),
+ skb->csum));

/* Check if TCP FIN or RST */