Update the inner IP header checksum when rewriting addresses inside ICMP error payloads, matching netfilter's nf_nat_ipv4_manip_pkt() behavior. Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT") Cc: stable@vger.kernel.org Signed-off-by: David Carlier --- net/sched/act_nat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c index abb332dee836..cd1d299da57c 100644 --- a/net/sched/act_nat.c +++ b/net/sched/act_nat.c @@ -242,7 +242,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb, new_addr &= mask; new_addr |= addr & ~mask; - /* XXX Fix up the inner checksums. */ + /* Update inner IP header checksum after address rewrite */ + csum_replace4(&iph->check, addr, new_addr); + if (egress) iph->daddr = new_addr; else -- 2.53.0