diff options
author | Kevin Mitchell <kevmitch@arista.com> | 2022-01-15 07:00:50 +0300 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-02-04 08:30:27 +0300 |
commit | 5bed9f3f63f8f9d2b1758c24640cbf77b5377511 (patch) | |
tree | c781542bb3757c40c28215c4b6ddef50e908383d /include/uapi/linux/netfilter | |
parent | 41414c9bdbb87cc5fbeee7dfc33137a96710fcac (diff) | |
download | linux-5bed9f3f63f8f9d2b1758c24640cbf77b5377511.tar.xz |
netfilter: conntrack: mark UDP zero checksum as CHECKSUM_UNNECESSARY
The udp_error function verifies the checksum of incoming UDP packets if
one is set. This has the desirable side effect of setting skb->ip_summed
to CHECKSUM_COMPLETE, signalling that this verification need not be
repeated further up the stack.
Conversely, when the UDP checksum is empty, which is perfectly legal (at least
inside IPv4), udp_error previously left no trace that the checksum had been
deemed acceptable.
This was a problem in particular for nf_reject_ipv4, which verifies the
checksum in nf_send_unreach() before sending ICMP_DEST_UNREACH. It makes
no accommodation for zero UDP checksums unless they are already marked
as CHECKSUM_UNNECESSARY.
This commit ensures packets with empty UDP checksum are marked as
CHECKSUM_UNNECESSARY, which is explicitly recommended in skbuff.h.
Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/uapi/linux/netfilter')
0 files changed, 0 insertions, 0 deletions