diff options
| author |   Kevin Mitchell <kevmitch@arista.com> | 2022-01-14 20:00:50 -0800 |
|---|---|---|
| committer |   Pablo Neira Ayuso <pablo@netfilter.org> | 2022-02-04 06:30:27 +0100 |
| commit | 5bed9f3f63f8f9d2b1758c24640cbf77b5377511 (patch) | |
| tree | c781542bb3757c40c28215c4b6ddef50e908383d /include/uapi | |
| parent | net: lan966x: use .mac_select_pcs() interface (diff) | |
| download | linux-dev-5bed9f3f63f8f9d2b1758c24640cbf77b5377511.tar.xz linux-dev-5bed9f3f63f8f9d2b1758c24640cbf77b5377511.zip | |
netfilter: conntrack: mark UDP zero checksum as CHECKSUM_UNNECESSARY
The udp_error function verifies the checksum of incoming UDP packets if
one is set. This has the desirable side effect of setting skb->ip_summed
to CHECKSUM_COMPLETE, signalling that this verification need not be
repeated further up the stack.
Conversely, when the UDP checksum is empty, which is perfectly legal (at least
inside IPv4), udp_error previously left no trace that the checksum had been
deemed acceptable.
This was a problem in particular for nf_reject_ipv4, which verifies the
checksum in nf_send_unreach() before sending ICMP_DEST_UNREACH. It makes
no accommodation for zero UDP checksums unless they are already marked
as CHECKSUM_UNNECESSARY.
This commit ensures packets with empty UDP checksum are marked as
CHECKSUM_UNNECESSARY, which is explicitly recommended in skbuff.h.
Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/uapi')
0 files changed, 0 insertions, 0 deletions