[NETFILTER]: Fix HW checksum handling in TCPMSS target

Most importantly, remove bogus BUG() in receive path.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/netfilter/ipt_TCPMSS.c b/net/ipv4/netfilter/ipt_TCPMSS.c
index 1049050b2bfbc0a5123662548b37ac382e1cb11f..7b84a254440e79db82680e29e977367a887af718 100644 (file)
--- a/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -61,6 +61,10 @@ ipt_tcpmss_target(struct sk_buff **pskb,
        if (!skb_ip_make_writable(pskb, (*pskb)->len))
                return NF_DROP;
 
+       if ((*pskb)->ip_summed == CHECKSUM_HW &&
+           skb_checksum_help(*pskb, out == NULL))
+               return NF_DROP;
+
        iph = (*pskb)->nh.iph;
        tcplen = (*pskb)->len - iph->ihl*4;
 
@@ -186,9 +190,6 @@ ipt_tcpmss_target(struct sk_buff **pskb,
               newmss);
 
  retmodified:
-       /* We never hw checksum SYN packets.  */
-       BUG_ON((*pskb)->ip_summed == CHECKSUM_HW);
-
        (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
        return IPT_CONTINUE;
 }