nf_conntrack: validate crc32c on SCTP packets hitting PREROUTING hook
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest2 patches 2 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | netfilter: select LIBCRC32C together with SCTP conntracknet/ | +1 | 1 reply | |
| 2/2 | netfilter: conntrack: validate SCTP crc32c in PREROUTINGnet/ | +32 | 0 replies |
Reviews trailers per patch
1 of 2 patches has a Reviewed-by or Acked-by.
| Patch | Marcelo Ricardo Leitner |
|---|---|
| 1/2 | R-b |
| 2/2 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH nf-next 0/2] nf_conntrack: validate crc32c on SCTP packets hitting PREROUTING hook
unlike what happens with other protcols, conntrack entries are matched by SCTP packets even when crc32c is incorrect. Moreover, netfilter 'REJECT' target does not generate any ICMP on reception of SCTP packets, because it computes RFC 1624 checksum ad compares it with crc32c in the transport header, resulting in a systematic mismatch.
The above issues can be resolved by implementing .error() callback in SCTP conntrack helper. Patch 1 of this series lets LIBCRC32C be selected with NF_CT_PROTO_SCTP, to allow crc32c validation within nf_conntrack. Patch 2 implements .error() callback in nf_conntrack_l4proto_sctp{4,6}: like other protocols do with the Internet Checksum, sctp_error() validates crc32c in PREROUTING hook, updates the value of skb->ip_summed and returns the result of checksum validation to let conntrack core skip corrupted packets.
Davide Caratti (2):
netfilter: select LIBCRC32C together with SCTP conntrack
netfilter: conntrack: validate SCTP crc32c in PREROUTING
net/netfilter/Kconfig | 2 +- net/netfilter/nf_conntrack_proto_sctp.c | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 1 deletion(-)
Signature · 1 line
2.7.4