Messages in this thread | | | Date | Fri, 4 Feb 2022 06:09:07 +0100 | From | Pablo Neira Ayuso <> | Subject | Re: [PATCH 1/1] netfilter: conntrack: mark UDP zero checksum as CHECKSUM_UNNECESSARY |
| |
On Fri, Jan 14, 2022 at 08:00:50PM -0800, Kevin Mitchell wrote: > The udp_error function verifies the checksum of incoming UDP packets if > one is set. This has the desirable side effect of setting skb->ip_summed > to CHECKSUM_COMPLETE, signalling that this verification need not be > repeated further up the stack. > > Conversely, when the UDP checksum is empty, which is perfectly legal (at least > inside IPv4), udp_error previously left no trace that the checksum had been > deemed acceptable. > > This was a problem in particular for nf_reject_ipv4, which verifies the > checksum in nf_send_unreach() before sending ICMP_DEST_UNREACH. It makes > no accommodation for zero UDP checksums unless they are already marked > as CHECKSUM_UNNECESSARY. > > This commit ensures packets with empty UDP checksum are marked as > CHECKSUM_UNNECESSARY, which is explicitly recommended in skbuff.h.
Applied to nf-next
| |