Re: ERRATA Re: [PATCH] fix for netfilter/nat/pppoe crashes (hopefully)

["David S. Miller" <davem@xxxxxxxxxx>]

Harald Welte writes:
 > Sorry Rusty, but check on sizeof(struct tcphdr) is IMHO wrong, again.

I think there is no way you can validly drop an ICMP packet just
because the TCP checksum field is not there in the embedded header.

So I think I basically agree with Harald.

Nobody verifies the checksum of the TCP header included in the
ICMP anyways, and in fact most of the time you can't simply because
you'd need all the data part there to do so.

This code should just verify that the ports are there and
fix them up, and do nothing more, for the TCP in ICMP packet
case.

And pretty much this is what Harald's patch does if I read it
correctly.

Later,
David S. Miller
davem@xxxxxxxxxx