netfilter: add CHECKSUM target
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 15 Jul 2010 15:20:46 +0000 (17:20 +0200)
committerPatrick McHardy <kaber@trash.net>
Thu, 15 Jul 2010 15:20:46 +0000 (17:20 +0200)
commitedf0e1fb0d0910880881523cfaaabcec06a2c0d5
tree9b113e0d86d8119a35b2af076a789b92fa341913
parentfac42a9a922fe5eb87cac0b597010afb81e7ffe9
netfilter: add CHECKSUM target

This adds a `CHECKSUM' target, which can be used in the iptables mangle
table.

You can use this target to compute and fill in the checksum in
a packet that lacks a checksum.  This is particularly useful,
if you need to work around old applications such as dhcp clients,
that do not work well with checksum offloads, but don't want to
disable checksum offload in your device.

The problem happens in the field with virtualized applications.
For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):
iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
-j CHECKSUM --checksum-fill

Includes fixes by Jan Engelhardt <jengelh@medozas.de>

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
include/linux/netfilter/xt_CHECKSUM.h [new file with mode: 0644]
net/netfilter/Kconfig
net/netfilter/Makefile
net/netfilter/xt_CHECKSUM.c [new file with mode: 0644]