Skip to contentSkip to conversation

netfilter: Checksum of an IPv6 UDP packet is mandatory

PATCH In review Changli Gao 2 participants 2 messages Jun 28, 2013

Subsystems (2)
Networking netfilter
lore
Share & tools
lore

Changli Gao

author
#0 lore raw

PATCH 1/1 netfilter: Checksum of an IPv6 UDP packet is mandatory

Checksum of an IPv6 UDP packet is mandatory.

---
 net/netfilter/nf_conntrack_proto_udp.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_proto_udp.c +8 -1
index 9d7721c..31dc854 100644
@@ -134,8 +134,15 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
 	}
 
 	/* Packet with no checksum */
-	if (!hdr->check)
+	if (!hdr->check) {
+		if (pf == PF_INET6) {
+			if (LOG_INVALID(net, IPPROTO_UDP))
+				nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
+					       "nf_ct_udp: bad UDP checksum ");
+			return -NF_ACCEPT;
+		}
 		return NF_ACCEPT;
+	}
 
 	/* Checksum invalid? Ignore.
 	 * We skip checking packets on the outgoing path
Signature · 1 line
1.7.9.5
maintainer
#1 lore raw
Quoted 1 line · Changli Gao

Checksum of an IPv6 UDP packet is mandatory.

There is some discussion on this:

http://tools.ietf.org/html/rfc6936

"The inability to use an IPv6 datagram with a zero UDP checksum has
been found to be a real problem for certain classes of application, primarily tunnel applications."

Quoted 28 lines
---
 net/netfilter/nf_conntrack_proto_udp.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_proto_udp.c +8 -1
index 9d7721c..31dc854 100644
@@ -134,8 +134,15 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
 	}
 
 	/* Packet with no checksum */
-	if (!hdr->check)
+	if (!hdr->check) {
+		if (pf == PF_INET6) {
+			if (LOG_INVALID(net, IPPROTO_UDP))
+				nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
+					       "nf_ct_udp: bad UDP checksum ");
+			return -NF_ACCEPT;
+		}
 		return NF_ACCEPT;
+	}
 
 	/* Checksum invalid? Ignore.
 	 * We skip checking packets on the outgoing path
Signature · 1 line
1.7.9.5