Skip to contentSkip to conversation

netfilter: add CHECKSUM target

PATCH Superseded Michael S. Tsirkin 3 participants 23 messages Jul 11, 2010 – Jul 15, 2010

Subsystems (4)
Networking Network drivers KVM netfilter

v2 of 4 Superseded Latest is v4 →

lore
Share & tools
lore

Michael S. Tsirkin

author
#0 lore raw

PATCH v2 1/1 netfilter: add CHECKSUM target

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):

iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
	-j CHECKSUM --checksum-fill
Signed-off-by Michael S. Tsirkin <[email protected]>

---

Changes from v1:
moved from ipt to xt
get rid of any ipv4 dependencies
coding style tweaks

 include/linux/netfilter/xt_CHECKSUM.h |   18 ++++++++
 net/netfilter/Kconfig                 |   17 +++++++-
 net/netfilter/Makefile                |    1 +
 net/netfilter/xt_CHECKSUM.c           |   72 +++++++++++++++++++++++++++++++++
 4 files changed, 107 insertions(+), 1 deletions(-)
 create mode 100644 include/linux/netfilter/xt_CHECKSUM.h
 create mode 100644 net/netfilter/xt_CHECKSUM.c
include/linux/netfilter/xt_CHECKSUM.h new file +18 -0
new file mode 100644
index 0000000..56afe57
@@ -0,0 +1,18 @@
+/* Header file for iptables ipt_CHECKSUM target
+ *
+ * (C) 2002 by Harald Welte <[email protected]>
+ * (C) 2010 Red Hat Inc
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This software is distributed under GNU GPL v2, 1991
+*/
+#ifndef _IPT_CHECKSUM_TARGET_H
+#define _IPT_CHECKSUM_TARGET_H
+
+#define XT_CHECKSUM_OP_FILL	0x01	/* fill in checksum in IP header */
+
+struct xt_CHECKSUM_info {
+	u_int8_t operation;	/* bitset of operations */
+};
+
+#endif /* _IPT_CHECKSUM_TARGET_H */
net/netfilter/Kconfig +16 -1
index 8593a77..1cf4852 100644
@@ -294,7 +294,7 @@ endif # NF_CONNTRACK
 config NETFILTER_TPROXY
 	tristate "Transparent proxying support (EXPERIMENTAL)"
 	depends on EXPERIMENTAL
-	depends on IP_NF_MANGLE
+	depends on IP_NF_MANGLE || IP6_NF_MANGLE
 	depends on NETFILTER_ADVANCED
 	help
 	  This option enables transparent proxying support, that is,

@@ -347,6 +347,21 @@ config NETFILTER_XT_CONNMARK
 
 comment "Xtables targets"
 
+config NETFILTER_XT_TARGET_CHECKSUM
+	tristate "CHECKSUM target support"
+	depends on NETFILTER_ADVANCED
+	---help---
+	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
+	  table.  
+
+	  You can use this target to compute and fill in the checksum in
+	  a packet that lacks a checksum.  This is particularly useful,
+	  if you need to work around old applications such as dhcp clients,
+	  that do not work well with checksum offloads, but don't want to disable
+	  checksum offload in your device.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_CLASSIFY
 	tristate '"CLASSIFY" target support'
 	depends on NETFILTER_ADVANCED
net/netfilter/Makefile +1 -0
index 14e3a8f..8eb541d 100644
@@ -45,6 +45,7 @@ obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o
 obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o
 
 # targets
+obj-$(CONFIG_NETFILTER_XT_TARGET_CHECKSUM) += xt_CHECKSUM.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
net/netfilter/xt_CHECKSUM.c new file +72 -0

72 lines not on this page · raw message

Signature · 1 line
1.7.2.rc0.14.g41c1c
author
#1 lore raw

PATCH v2 1/1 extensions: libxt_CHECKSUM extension

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Signed-off-by Michael S. Tsirkin <[email protected]>

---

Changes from v1:
switched from ipt to xt target

 extensions/libipt_CHECKSUM.man |    8 +++
 extensions/libxt_CHECKSUM.c    |   99 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libipt_CHECKSUM.man
 create mode 100644 extensions/libxt_CHECKSUM.c
extensions/libipt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..4f83335
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
extensions/libxt_CHECKSUM.c new file +99 -0

99 lines not on this page · raw message

author
#2 lore raw

PATCH v2 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Signed-off-by Michael S. Tsirkin <[email protected]>

---

Changes from v1:
switched from ipt to xt target

 extensions/libipt_CHECKSUM.man |    8 +++
 extensions/libxt_CHECKSUM.c    |   99 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libipt_CHECKSUM.man
 create mode 100644 extensions/libxt_CHECKSUM.c
extensions/libipt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..4f83335
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
extensions/libxt_CHECKSUM.c new file +99 -0

99 lines not on this page · raw message

author
#3 lore raw

PATCH v2 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Signed-off-by Michael S. Tsirkin <[email protected]>

---

Changes from v1:
switched from ipt to xt target

 extensions/libipt_CHECKSUM.man |    8 +++
 extensions/libxt_CHECKSUM.c    |   99 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libipt_CHECKSUM.man
 create mode 100644 extensions/libxt_CHECKSUM.c
extensions/libipt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..4f83335
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
extensions/libxt_CHECKSUM.c new file +99 -0

99 lines not on this page · raw message

author
#4 lore raw

PATCH v2 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Signed-off-by Michael S. Tsirkin <[email protected]>

---

Changes from v1:
switched from ipt to xt target

 extensions/libipt_CHECKSUM.man |    8 +++
 extensions/libxt_CHECKSUM.c    |   99 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libipt_CHECKSUM.man
 create mode 100644 extensions/libxt_CHECKSUM.c
extensions/libipt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..4f83335
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
extensions/libxt_CHECKSUM.c new file +99 -0

99 lines not on this page · raw message

author
#5 lore raw

PATCH v3 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):

iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
        -j CHECKSUM --checksum-fill
Signed-off-by Michael S. Tsirkin <[email protected]>

---

Correction in the documentation. Sorry about the noise.

Changes from v2:
updated man file
Changes from v1:
switched from ipt to xt

 extensions/libxt_CHECKSUM.c   |   99 +++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_CHECKSUM.man |    8 +++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_CHECKSUM.c
 create mode 100644 extensions/libxt_CHECKSUM.man
extensions/libxt_CHECKSUM.c new file +99 -0
new file mode 100644
index 0000000..00fbd8f
@@ -0,0 +1,99 @@
+/* Shared library add-on to xtables for CHECKSUM
+ *
+ * (C) 2002 by Harald Welte <[email protected]>
+ * (C) 2010 by Red Hat, Inc
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This program is distributed under the terms of GNU GPL v2, 1991
+ *
+ * libxt_CHECKSUM.c borrowed some bits from libipt_ECN.c
+ *
+ * $Id$
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_CHECKSUM.h>
+
+static void CHECKSUM_help(void)
+{
+	printf(
+"CHECKSUM target options\n"
+"  --checksum-fill			Fill in packet checksum.\n");
+}
+
+static const struct option CHECKSUM_opts[] = {
+	{ "checksum-fill", 0, NULL, 'F' },
+	{ .name = NULL }
+};
+
+static int CHECKSUM_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_target **target)
+{
+	struct xt_CHECKSUM_info *einfo
+		= (struct xt_CHECKSUM_info *)(*target)->data;
+
+	switch (c) {
+	case 'F':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+			        "CHECKSUM target: Only use --checksum-fill ONCE!");
+		einfo->operation = XT_CHECKSUM_OP_FILL;
+		*flags |= XT_CHECKSUM_OP_FILL;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void CHECKSUM_check(unsigned int flags)
+{
+	if (!flags)
+		xtables_error(PARAMETER_PROBLEM,
+		           "CHECKSUM target: Parameter --checksum-fill is required");
+}
+
+static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target,
+                      int numeric)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	printf("CHECKSUM ");
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("fill ");
+}
+
+static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("--checksum-fill ");
+}
+
+static struct xtables_target checksum_tg_reg = {
+	.name		= "CHECKSUM",
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_UNSPEC,
+	.size		= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.help		= CHECKSUM_help,
+	.parse		= CHECKSUM_parse,
+	.final_check	= CHECKSUM_check,
+	.print		= CHECKSUM_print,
+	.save		= CHECKSUM_save,
+	.extra_opts	= CHECKSUM_opts,
+};
+
+void _init(void)
+{
+	xtables_register_target(&checksum_tg_reg);
+}
extensions/libxt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..92ae700
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
Signature · 1 line
1.7.2.rc0.14.g41c1c
author
#6 lore raw

PATCH v3 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):

iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
        -j CHECKSUM --checksum-fill
Signed-off-by Michael S. Tsirkin <[email protected]>

---

Correction in the documentation. Sorry about the noise.

Changes from v2:
updated man file
Changes from v1:
switched from ipt to xt

 extensions/libxt_CHECKSUM.c   |   99 +++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_CHECKSUM.man |    8 +++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_CHECKSUM.c
 create mode 100644 extensions/libxt_CHECKSUM.man
extensions/libxt_CHECKSUM.c new file +99 -0
new file mode 100644
index 0000000..00fbd8f
@@ -0,0 +1,99 @@
+/* Shared library add-on to xtables for CHECKSUM
+ *
+ * (C) 2002 by Harald Welte <[email protected]>
+ * (C) 2010 by Red Hat, Inc
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This program is distributed under the terms of GNU GPL v2, 1991
+ *
+ * libxt_CHECKSUM.c borrowed some bits from libipt_ECN.c
+ *
+ * $Id$
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_CHECKSUM.h>
+
+static void CHECKSUM_help(void)
+{
+	printf(
+"CHECKSUM target options\n"
+"  --checksum-fill			Fill in packet checksum.\n");
+}
+
+static const struct option CHECKSUM_opts[] = {
+	{ "checksum-fill", 0, NULL, 'F' },
+	{ .name = NULL }
+};
+
+static int CHECKSUM_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_target **target)
+{
+	struct xt_CHECKSUM_info *einfo
+		= (struct xt_CHECKSUM_info *)(*target)->data;
+
+	switch (c) {
+	case 'F':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+			        "CHECKSUM target: Only use --checksum-fill ONCE!");
+		einfo->operation = XT_CHECKSUM_OP_FILL;
+		*flags |= XT_CHECKSUM_OP_FILL;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void CHECKSUM_check(unsigned int flags)
+{
+	if (!flags)
+		xtables_error(PARAMETER_PROBLEM,
+		           "CHECKSUM target: Parameter --checksum-fill is required");
+}
+
+static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target,
+                      int numeric)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	printf("CHECKSUM ");
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("fill ");
+}
+
+static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("--checksum-fill ");
+}
+
+static struct xtables_target checksum_tg_reg = {
+	.name		= "CHECKSUM",
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_UNSPEC,
+	.size		= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.help		= CHECKSUM_help,
+	.parse		= CHECKSUM_parse,
+	.final_check	= CHECKSUM_check,
+	.print		= CHECKSUM_print,
+	.save		= CHECKSUM_save,
+	.extra_opts	= CHECKSUM_opts,
+};
+
+void _init(void)
+{
+	xtables_register_target(&checksum_tg_reg);
+}
extensions/libxt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..92ae700
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
Signature · 1 line
1.7.2.rc0.14.g41c1c
#7 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 10 lines

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

Quoted 3 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

author
#8 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 10 lines · Jan Engelhardt
Quoted 10 lines

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

Quoted 5 lines
Quoted 3 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

Please do not drop the explanation that bits were copied from ECN.c.

Signature · 1 line
MST
#9 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 8 lines · Michael S. Tsirkin
Quoted 6 lines
Quoted 4 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

Please do not drop the explanation that bits were copied from ECN.c.

As far as I see it, there is nothing that deals with ECN in any way.

author
#10 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 7 lines · Jan Engelhardt
Quoted 5 lines · Michael S. Tsirkin
Quoted 5 lines
Quoted 4 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Quoted 5 lines
Quoted 3 lines
Quoted 1 line

Added to Xtables-addons.

Please do not drop the explanation that bits were copied from ECN.c.

As far as I see it, there is nothing that deals with ECN in any way.

No, the bits I copied deal with libxt boilerplate.

Signature · 1 line
MST
#11 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 6 lines · Michael S. Tsirkin
Quoted 6 lines · Michael S. Tsirkin
Quoted 5 lines
Quoted 5 lines
Quoted 4 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Quoted 7 lines
Quoted 5 lines
Quoted 3 lines
Quoted 1 line

Added to Xtables-addons.

Please do not drop the explanation that bits were copied from ECN.c.

As far as I see it, there is nothing that deals with ECN in any way.

No, the bits I copied deal with libxt boilerplate.

Falls into the category of triviality, doesn't reach a level of originality.

author
#12 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 10 lines · Jan Engelhardt
Quoted 8 lines · Michael S. Tsirkin
Quoted 8 lines · Michael S. Tsirkin
Quoted 7 lines
Quoted 6 lines
Quoted 4 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

Quoted 7 lines
Quoted 5 lines
Quoted 3 lines
Quoted 1 line

Please do not drop the explanation that bits were copied from ECN.c.

As far as I see it, there is nothing that deals with ECN in any way.

No, the bits I copied deal with libxt boilerplate.

Falls into the category of triviality, doesn't reach a level of originality.

In that case the 2002 copyright doesn't need to be there as well?

Signature · 1 line
MST
#13 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 7 lines · Michael S. Tsirkin
Quoted 5 lines
Quoted 3 lines
Quoted 1 line

As far as I see it, there is nothing that deals with ECN in any way.

No, the bits I copied deal with libxt boilerplate.

Falls into the category of triviality, doesn't reach a level of originality.

In that case the 2002 copyright doesn't need to be there as well?

Perhaps, but IANAL.

author
#14 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 10 lines · Jan Engelhardt
Quoted 7 lines · Michael S. Tsirkin
Quoted 5 lines
Quoted 3 lines
Quoted 1 line

As far as I see it, there is nothing that deals with ECN in any way.

No, the bits I copied deal with libxt boilerplate.

Falls into the category of triviality, doesn't reach a level of originality.

In that case the 2002 copyright doesn't need to be there as well?

Perhaps, but IANAL.

I put it there because of the copied bits. If you say they are trivial, strip that off, if not, better keep the attribution as well.

Signature · 1 line
MST
author
#15 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

In reply to Jan Engelhardt
Quoted 10 lines · Jan Engelhardt
Quoted 10 lines

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

Quoted 5 lines
Quoted 3 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

Looks like .man file is missing. Intentional?
It's there in v3 of the patch.

Signature · 1 line
MST
#16 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 9 lines · Michael S. Tsirkin
Quoted 6 lines
Quoted 4 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

Looks like .man file is missing. Intentional?
It's there in v3 of the patch.

21:57 yaguchi:../addons/extensions > l *CHEC* -rw-r--r-- 1 jengelh users 2358 Jul 11 21:29 libxt_CHECKSUM.c -rw-r--r-- 1 jengelh users 409 Jul 11 21:29 libxt_CHECKSUM.man -rw-r--r-- 1 jengelh users 1862 Jul 11 21:29 xt_CHECKSUM.c -rw-r--r-- 1 jengelh users 481 Jul 11 21:29 xt_CHECKSUM.h

author
#17 lore raw

Re: [PATCHv2] extensions: libxt_CHECKSUM extension

Quoted 13 lines · Jan Engelhardt
Quoted 9 lines · Michael S. Tsirkin
Quoted 6 lines
Quoted 4 lines

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Added to Xtables-addons.

Looks like .man file is missing. Intentional?
It's there in v3 of the patch.

21:57 yaguchi:../addons/extensions > l *CHEC*

Review

Quoted 4 lines
(quoted diff) +0 -4
-rw-r--r-- 1 jengelh users 2358 Jul 11 21:29 libxt_CHECKSUM.c
-rw-r--r-- 1 jengelh users  409 Jul 11 21:29 libxt_CHECKSUM.man
-rw-r--r-- 1 jengelh users 1862 Jul 11 21:29 xt_CHECKSUM.c
-rw-r--r-- 1 jengelh users  481 Jul 11 21:29 xt_CHECKSUM.h

See it now. Sorry about the noise.

#18 lore raw

Re: [PATCHv3] extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

Am 11.07.2010 17:14, schrieb Michael S. Tsirkin:

Quoted 7 lines
extensions/libxt_CHECKSUM.c new file +1 -0
new file mode 100644
index 0000000..00fbd8f
@@ -0,0 +1,99 @@
+/* Shared library add-on to xtables for CHECKSUM

extensions/libxt_CHECKSUM.c line 11

Quoted 10 lines
extensions/libxt_CHECKSUM.c new file +10 -0
+ *
+ * (C) 2002 by Harald Welte <[email protected]>
+ * (C) 2010 by Red Hat, Inc
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This program is distributed under the terms of GNU GPL v2, 1991
+ *
+ * libxt_CHECKSUM.c borrowed some bits from libipt_ECN.c
+ *
+ * $Id$

Please no CVS IDs.

Quoted 22 lines
extensions/libxt_CHECKSUM.c new file +22 -0
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_CHECKSUM.h>
+
+static void CHECKSUM_help(void)
+{
+	printf(
+"CHECKSUM target options\n"
+"  --checksum-fill			Fill in packet checksum.\n");
+}
+
+static const struct option CHECKSUM_opts[] = {
+	{ "checksum-fill", 0, NULL, 'F' },
+	{ .name = NULL }
+};
+
+static int CHECKSUM_parse(int c, char **argv, int invert, unsigned int *flags,

extensions/libxt_CHECKSUM.c line 43

Quoted 10 lines
extensions/libxt_CHECKSUM.c new file +10 -0
+                     const void *entry, struct xt_entry_target **target)
+{
+	struct xt_CHECKSUM_info *einfo
+		= (struct xt_CHECKSUM_info *)(*target)->data;
+
+	switch (c) {
+	case 'F':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+			        "CHECKSUM target: Only use --checksum-fill ONCE!");

There is a helper function called xtables_param_act for checking double arguments and printing a standarized error message.

Quoted 10 lines
extensions/libxt_CHECKSUM.c new file +10 -0
+		einfo->operation = XT_CHECKSUM_OP_FILL;
+		*flags |= XT_CHECKSUM_OP_FILL;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
#19 lore raw

Re: several messages

Quoted 13 lines · Patrick McHardy

Review

Quoted 2 lines
(quoted diff) +2 -0
+struct xt_CHECKSUM_info {
+	u_int8_t operation;	/* bitset of operations */

Please use __u8 in public header files.

Quoted 1 line

+#include <linux/in.h>

Do you really need in.h?

Quoted 1 line

+ * $Id$

Please no CVS IDs.

Quoted 8 lines

extensions/libxt_CHECKSUM.c line 43

Quoted 5 lines
extensions/libxt_CHECKSUM.c new file +5 -0
+	switch (c) {
+	case 'F':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+			        "CHECKSUM target: Only use --checksum-fill ONCE!");

There is a helper function called xtables_param_act for checking double arguments and printing a standarized error message.

I took care of these for Xt-a.

author
#20 lore raw

PATCH v3 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):

iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
        -j CHECKSUM --checksum-fill
Signed-off-by Michael S. Tsirkin <[email protected]>

---

Correction in the documentation. Sorry about the noise.

Changes from v2:
updated man file
Changes from v1:
switched from ipt to xt

 extensions/libxt_CHECKSUM.c   |   99 +++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_CHECKSUM.man |    8 +++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_CHECKSUM.c
 create mode 100644 extensions/libxt_CHECKSUM.man
extensions/libxt_CHECKSUM.c new file +99 -0
new file mode 100644
index 0000000..00fbd8f
@@ -0,0 +1,99 @@
+/* Shared library add-on to xtables for CHECKSUM
+ *
+ * (C) 2002 by Harald Welte <[email protected]>
+ * (C) 2010 by Red Hat, Inc
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This program is distributed under the terms of GNU GPL v2, 1991
+ *
+ * libxt_CHECKSUM.c borrowed some bits from libipt_ECN.c
+ *
+ * $Id$
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_CHECKSUM.h>
+
+static void CHECKSUM_help(void)
+{
+	printf(
+"CHECKSUM target options\n"
+"  --checksum-fill			Fill in packet checksum.\n");
+}
+
+static const struct option CHECKSUM_opts[] = {
+	{ "checksum-fill", 0, NULL, 'F' },
+	{ .name = NULL }
+};
+
+static int CHECKSUM_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_target **target)
+{
+	struct xt_CHECKSUM_info *einfo
+		= (struct xt_CHECKSUM_info *)(*target)->data;
+
+	switch (c) {
+	case 'F':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+			        "CHECKSUM target: Only use --checksum-fill ONCE!");
+		einfo->operation = XT_CHECKSUM_OP_FILL;
+		*flags |= XT_CHECKSUM_OP_FILL;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void CHECKSUM_check(unsigned int flags)
+{
+	if (!flags)
+		xtables_error(PARAMETER_PROBLEM,
+		           "CHECKSUM target: Parameter --checksum-fill is required");
+}
+
+static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target,
+                      int numeric)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	printf("CHECKSUM ");
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("fill ");
+}
+
+static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("--checksum-fill ");
+}
+
+static struct xtables_target checksum_tg_reg = {
+	.name		= "CHECKSUM",
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_UNSPEC,
+	.size		= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.help		= CHECKSUM_help,
+	.parse		= CHECKSUM_parse,
+	.final_check	= CHECKSUM_check,
+	.print		= CHECKSUM_print,
+	.save		= CHECKSUM_save,
+	.extra_opts	= CHECKSUM_opts,
+};
+
+void _init(void)
+{
+	xtables_register_target(&checksum_tg_reg);
+}
extensions/libxt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..92ae700
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
Signature · 1 line
1.7.2.rc0.14.g41c1c
author
#21 lore raw

PATCH v3 1/1 extensions: libxt_CHECKSUM extension

In reply to Michael S. Tsirkin

This adds a `CHECKSUM' target, which can be used in the iptables mangle table.

You can use this target to compute and fill in the checksum in a packet that lacks a checksum. This is particularly useful, if you need to work around old applications such as dhcp clients, that do not work well with checksum offloads, but don't want to disable checksum offload in your device.

The problem happens in the field with virtualized applications. For reference, see Red Hat bz 605555, as well as
http://www.spinics.net/lists/kvm/msg37660.html

Typical expected use (helps old dhclient binary running in a VM):

iptables -A POSTROUTING -t mangle -p udp --dport bootpc \
        -j CHECKSUM --checksum-fill
Signed-off-by Michael S. Tsirkin <[email protected]>

---

Correction in the documentation. Sorry about the noise.

Changes from v2:
updated man file
Changes from v1:
switched from ipt to xt

 extensions/libxt_CHECKSUM.c   |   99 +++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_CHECKSUM.man |    8 +++
 2 files changed, 107 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_CHECKSUM.c
 create mode 100644 extensions/libxt_CHECKSUM.man
extensions/libxt_CHECKSUM.c new file +99 -0
new file mode 100644
index 0000000..00fbd8f
@@ -0,0 +1,99 @@
+/* Shared library add-on to xtables for CHECKSUM
+ *
+ * (C) 2002 by Harald Welte <[email protected]>
+ * (C) 2010 by Red Hat, Inc
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This program is distributed under the terms of GNU GPL v2, 1991
+ *
+ * libxt_CHECKSUM.c borrowed some bits from libipt_ECN.c
+ *
+ * $Id$
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_CHECKSUM.h>
+
+static void CHECKSUM_help(void)
+{
+	printf(
+"CHECKSUM target options\n"
+"  --checksum-fill			Fill in packet checksum.\n");
+}
+
+static const struct option CHECKSUM_opts[] = {
+	{ "checksum-fill", 0, NULL, 'F' },
+	{ .name = NULL }
+};
+
+static int CHECKSUM_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_target **target)
+{
+	struct xt_CHECKSUM_info *einfo
+		= (struct xt_CHECKSUM_info *)(*target)->data;
+
+	switch (c) {
+	case 'F':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+			        "CHECKSUM target: Only use --checksum-fill ONCE!");
+		einfo->operation = XT_CHECKSUM_OP_FILL;
+		*flags |= XT_CHECKSUM_OP_FILL;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void CHECKSUM_check(unsigned int flags)
+{
+	if (!flags)
+		xtables_error(PARAMETER_PROBLEM,
+		           "CHECKSUM target: Parameter --checksum-fill is required");
+}
+
+static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target,
+                      int numeric)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	printf("CHECKSUM ");
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("fill ");
+}
+
+static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf("--checksum-fill ");
+}
+
+static struct xtables_target checksum_tg_reg = {
+	.name		= "CHECKSUM",
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_UNSPEC,
+	.size		= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.help		= CHECKSUM_help,
+	.parse		= CHECKSUM_parse,
+	.final_check	= CHECKSUM_check,
+	.print		= CHECKSUM_print,
+	.save		= CHECKSUM_save,
+	.extra_opts	= CHECKSUM_opts,
+};
+
+void _init(void)
+{
+	xtables_register_target(&checksum_tg_reg);
+}
extensions/libxt_CHECKSUM.man new file +8 -0
new file mode 100644
index 0000000..92ae700
@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.
Signature · 1 line
1.7.2.rc0.14.g41c1c
#22 lore raw
In reply to Michael S. Tsirkin

Am 11.07.2010 17:06, schrieb Michael S. Tsirkin:

include/linux/netfilter/xt_CHECKSUM.h line 15

Quoted 7 lines
include/linux/netfilter/xt_CHECKSUM.h new file +7 -0
+#ifndef _IPT_CHECKSUM_TARGET_H
+#define _IPT_CHECKSUM_TARGET_H
+
+#define XT_CHECKSUM_OP_FILL	0x01	/* fill in checksum in IP header */
+
+struct xt_CHECKSUM_info {
+	u_int8_t operation;	/* bitset of operations */

Please use __u8 in public header files.

net/netfilter/Kconfig endif # NF_CONNTRACK · line 297

Quoted 13 lines
include/linux/netfilter/xt_CHECKSUM.h new file +3 -0
+};
+
+#endif /* _IPT_CHECKSUM_TARGET_H */
net/netfilter/Kconfig +1 -1
index 8593a77..1cf4852 100644
@@ -294,7 +294,7 @@ endif # NF_CONNTRACK
 config NETFILTER_TPROXY
 	tristate "Transparent proxying support (EXPERIMENTAL)"
 	depends on EXPERIMENTAL
-	depends on IP_NF_MANGLE
+	depends on IP_NF_MANGLE || IP6_NF_MANGLE

This does not seem to belong into this patch.

net/netfilter/Kconfig config NETFILTER_XT_CONNMARK · line 355

Quoted 13 lines
net/netfilter/Kconfig +6 -0
 	depends on NETFILTER_ADVANCED
 	help
 	  This option enables transparent proxying support, that is,

@@ -347,6 +347,21 @@ config NETFILTER_XT_CONNMARK
 
 comment "Xtables targets"
 
+config NETFILTER_XT_TARGET_CHECKSUM
+	tristate "CHECKSUM target support"
+	depends on NETFILTER_ADVANCED
+	---help---
+	  This option adds a `CHECKSUM' target, which can be used in the iptables mangle
+	  table.

You should add a dependency on the mangle table then.

Quoted 33 lines
net/netfilter/Kconfig +9 -0
+
+	  You can use this target to compute and fill in the checksum in
+	  a packet that lacks a checksum.  This is particularly useful,
+	  if you need to work around old applications such as dhcp clients,
+	  that do not work well with checksum offloads, but don't want to disable
+	  checksum offload in your device.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_TARGET_CLASSIFY
 	tristate '"CLASSIFY" target support'
 	depends on NETFILTER_ADVANCED
net/netfilter/Makefile +1 -0
index 14e3a8f..8eb541d 100644
@@ -45,6 +45,7 @@ obj-$(CONFIG_NETFILTER_XT_MARK) += xt_mark.o
 obj-$(CONFIG_NETFILTER_XT_CONNMARK) += xt_connmark.o
 
 # targets
+obj-$(CONFIG_NETFILTER_XT_TARGET_CHECKSUM) += xt_CHECKSUM.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
 obj-$(CONFIG_NETFILTER_XT_TARGET_CT) += xt_CT.o
net/netfilter/xt_CHECKSUM.c new file +3 -0
new file mode 100644
index 0000000..0fee1a7
@@ -0,0 +1,72 @@
+/* iptables module for the packet checksum mangling
+ *
+ * (C) 2002 by Harald Welte <[email protected]>

net/netfilter/xt_CHECKSUM.c line 13

Quoted 10 lines
net/netfilter/xt_CHECKSUM.c new file +10 -0
+ * (C) 2010 Red Hat, Inc.
+ *
+ * Author: Michael S. Tsirkin <[email protected]>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/in.h>

Do you really need in.h?

Quoted 59 lines
net/netfilter/xt_CHECKSUM.c new file +59 -0
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_CHECKSUM.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Michael S. Tsirkin <[email protected]>");
+MODULE_DESCRIPTION("Xtables: checksum modification");
+MODULE_ALIAS("ipt_CHECKSUM");
+MODULE_ALIAS("ip6t_CHECKSUM");
+
+static unsigned int
+checksum_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	if (skb->ip_summed == CHECKSUM_PARTIAL)
+		skb_checksum_help(skb);
+
+	return XT_CONTINUE;
+}
+
+static int checksum_tg_check(const struct xt_tgchk_param *par)
+{
+	const struct xt_CHECKSUM_info *einfo = par->targinfo;
+
+	if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
+		pr_info("unsupported CHECKSUM operation %x\n", einfo->operation);
+		return -EINVAL;
+	}
+	if (!einfo->operation) {
+		pr_info("no CHECKSUM operation enabled\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static struct xt_target checksum_tg_reg __read_mostly = {
+	.name		= "CHECKSUM",
+	.family		= NFPROTO_UNSPEC,
+	.target		= checksum_tg,
+	.targetsize	= sizeof(struct xt_CHECKSUM_info),
+	.table		= "mangle",
+	.checkentry	= checksum_tg_check,
+	.me		= THIS_MODULE,
+};
+
+static int __init checksum_tg_init(void)
+{
+	return xt_register_target(&checksum_tg_reg);
+}
+
+static void __exit checksum_tg_exit(void)
+{
+	xt_unregister_target(&checksum_tg_reg);
+}
+
+module_init(checksum_tg_init);
+module_exit(checksum_tg_exit);