bpf: Correct refinement of inner packet L4 checksum detection#43868
Merged
julianwiedmann merged 1 commit intocilium:mainfrom Jan 21, 2026
Merged
bpf: Correct refinement of inner packet L4 checksum detection#43868julianwiedmann merged 1 commit intocilium:mainfrom
julianwiedmann merged 1 commit intocilium:mainfrom
Conversation
Contributor
Author
|
@yushoyamaguchi @pchaigno |
ff1dc74 to
4450925
Compare
smagnani96
requested changes
Jan 20, 2026
e543e6e to
0a22318
Compare
The previous commit updating short ICMP error packet NAT handling improperly computed the length of a short packet by neglecting to account for the ihl field of the IP header representing 32 bit words rather than bytes. This caused a reversion of cilium#33844. Furthermore, the change in short packet detection depends on the incoming bpf_context structure having the "len" field set correctly, which the BPF tests for that condition did not set. This corrects the comparison for the inner L4 packet length and updates the short ICMP error packet BPF tests to ensure the ctx->len field is set like the kernel does. Fixes: cilium@1a018d56d623 ("bpf: Refine inner packet L4 checksum detection") Signed-off-by: Bill Reese <ReeseW@computer.org>
0a22318 to
4b20127
Compare
Contributor
|
/test |
smagnani96
approved these changes
Jan 21, 2026
Contributor
smagnani96
left a comment
There was a problem hiding this comment.
LGTM, thanks!
@julianwiedmann I added labels, feel free to make any needed adjustment.
I see the original PR has been backported to v1.18, so we need this in v1.18 and v1.19 too.
Member
|
Thank you! |
Member
|
We're still missing a release note here. |
Contributor
I thought PR title was enough, but maybe not too representative. @br4243 Refer to the Development Doc. We usually include that at the end of the PR description, which will be used when generating release notes. I gave it a shot (changed PR description), please double check and adjust accordingly if needed. |
Member
It's too generic. We'd need something that tells users exactly who's concerned and what the impact is. One way to achieve that is to follow the pattern |
Contributor
Author
|
Thank you for the pointers on the release notes; I'll be sure to include that next time! |
Member
|
@br4243 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous commit updating short ICMP error packet NAT handling improperly computed the length of a short packet by neglecting to account for the ihl field of the IP header representing 32 bit words rather than bytes. This caused a reversion of #33844.
Furthermore, the change in short packet detection depends on the incoming bpf_context structure having the "len" field set correctly, which the BPF tests for that condition did not set.
This corrects the comparison for the inner L4 packet length and updates the short ICMP error packet BPF tests to ensure the ctx->len field is set like the kernel does.
Fixes: 1a018d56d623 ("bpf: Refine inner packet L4 checksum detection")