Consider TCP/IPv4 packet with IP options: sizeof(*iph) + sizeof(struct
tcphdr) is not enough to include tcp checksum. It may hurt if this
packet is fragmented.
Therefore, we should use iph->ihl * 4 instead of sizeof(*iph).
Signed-off-by: Dmitry Popov <dp@highloadlab.com>
Upstream commit v3.5-rc1~109^2~138^2~4 ("netfilter: ip6_tables: add
flags parameter to ipv6_find_hdr()") changed the offset parameter of
ipv6_find_hdr() to be an input-output value. Moreover, if it is
non-zero, it MUST point to a valid IPv6 header embedded in the
packet.
In case the kernel is built without IPv6 support the compilation of
this module fails as it assumes IPv6. This patch makes kernel support
conditional on kernel .config.
