| Message ID | 20220115040050.187972-2-kevmitch@arista.com |
|---|---|
| State | Accepted |
| Delegated to: | Pablo Neira |
| Headers | show |
| Series | UDP traceroute packets with no checksum | expand |
Kevin Mitchell <kevmitch@arista.com> wrote: > The udp_error function verifies the checksum of incoming UDP packets if > one is set. This has the desirable side effect of setting skb->ip_summed > to CHECKSUM_COMPLETE, signalling that this verification need not be > repeated further up the stack. Acked-by: Florian Westphal <fw@strlen.de>
On Fri, Jan 14, 2022 at 08:00:50PM -0800, Kevin Mitchell wrote: > The udp_error function verifies the checksum of incoming UDP packets if > one is set. This has the desirable side effect of setting skb->ip_summed > to CHECKSUM_COMPLETE, signalling that this verification need not be > repeated further up the stack. > > Conversely, when the UDP checksum is empty, which is perfectly legal (at least > inside IPv4), udp_error previously left no trace that the checksum had been > deemed acceptable. > > This was a problem in particular for nf_reject_ipv4, which verifies the > checksum in nf_send_unreach() before sending ICMP_DEST_UNREACH. It makes > no accommodation for zero UDP checksums unless they are already marked > as CHECKSUM_UNNECESSARY. > > This commit ensures packets with empty UDP checksum are marked as > CHECKSUM_UNNECESSARY, which is explicitly recommended in skbuff.h. Applied to nf-next
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c index 3b516cffc779..12f793d8fe0c 100644 --- a/net/netfilter/nf_conntrack_proto_udp.c +++ b/net/netfilter/nf_conntrack_proto_udp.c @@ -63,8 +63,10 @@ static bool udp_error(struct sk_buff *skb, } /* Packet with no checksum */ - if (!hdr->check) + if (!hdr->check) { + skb->ip_summed = CHECKSUM_UNNECESSARY; return false; + } /* Checksum invalid? Ignore. * We skip checking packets on the outgoing path
The udp_error function verifies the checksum of incoming UDP packets if one is set. This has the desirable side effect of setting skb->ip_summed to CHECKSUM_COMPLETE, signalling that this verification need not be repeated further up the stack. Conversely, when the UDP checksum is empty, which is perfectly legal (at least inside IPv4), udp_error previously left no trace that the checksum had been deemed acceptable. This was a problem in particular for nf_reject_ipv4, which verifies the checksum in nf_send_unreach() before sending ICMP_DEST_UNREACH. It makes no accommodation for zero UDP checksums unless they are already marked as CHECKSUM_UNNECESSARY. This commit ensures packets with empty UDP checksum are marked as CHECKSUM_UNNECESSARY, which is explicitly recommended in skbuff.h. Signed-off-by: Kevin Mitchell <kevmitch@arista.com> --- net/netfilter/nf_conntrack_proto_udp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)