Commit 4f9bd530 authored by Kevin Mitchell's avatar Kevin Mitchell Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: skip verification of zero UDP checksum 



The checksum is optional for UDP packets. However nf_reject would
previously require a valid checksum to elicit a response such as
ICMP_DEST_UNREACH.

Add some logic to nf_reject_verify_csum to determine if a UDP packet has
a zero checksum and should therefore not be verified.

Signed-off-by: default avatarKevin Mitchell <kevmitch@arista.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3412e164

include/net/netfilter/nf_reject.h

+17 −4
Original line number Diff line number Diff line
@@ -5,12 +5,28 @@ 
#include <linux/types.h>

#include <uapi/linux/in.h>



static inline bool nf_reject_verify_csum(__u8 proto)

static inline bool nf_reject_verify_csum(struct sk_buff *skb, int dataoff,

					  __u8 proto)

{

	/* Skip protocols that don't use 16-bit one's complement checksum

	 * of the entire payload.

	 */

	switch (proto) {

		/* Protocols with optional checksums. */

		case IPPROTO_UDP: {

			const struct udphdr *udp_hdr;

			struct udphdr _udp_hdr;



			udp_hdr = skb_header_pointer(skb, dataoff,

						     sizeof(_udp_hdr),

						     &_udp_hdr);

			if (!udp_hdr || udp_hdr->check)

				return true;



			return false;

		}

		case IPPROTO_GRE:



		/* Protocols with other integrity checks. */

		case IPPROTO_AH:

		case IPPROTO_ESP:
@@ -19,9 +35,6 @@ static inline bool nf_reject_verify_csum(__u8 proto) 
		/* Protocols with partial checksums. */

		case IPPROTO_UDPLITE:

		case IPPROTO_DCCP:



		/* Protocols with optional checksums. */

		case IPPROTO_GRE:

			return false;

	}

	return true;

net/ipv4/netfilter/nf_reject_ipv4.c

+7 −3
Original line number Diff line number Diff line
@@ -80,6 +80,7 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net, 
	struct iphdr *niph;

	struct icmphdr *icmph;

	unsigned int len;

	int dataoff;

	__wsum csum;

	u8 proto;
@@ -99,10 +100,11 @@ struct sk_buff *nf_reject_skb_v4_unreach(struct net *net, 
	if (pskb_trim_rcsum(oldskb, ntohs(ip_hdr(oldskb)->tot_len)))

		return NULL;



	dataoff = ip_hdrlen(oldskb);

	proto = ip_hdr(oldskb)->protocol;



	if (!skb_csum_unnecessary(oldskb) &&

	    nf_reject_verify_csum(proto) &&

	    nf_reject_verify_csum(oldskb, dataoff, proto) &&

	    nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), proto))

		return NULL;
@@ -311,6 +313,7 @@ EXPORT_SYMBOL_GPL(nf_send_reset); 
void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)

{

	struct iphdr *iph = ip_hdr(skb_in);

	int dataoff = ip_hdrlen(skb_in);

	u8 proto = iph->protocol;



	if (iph->frag_off & htons(IP_OFFSET))
@@ -320,12 +323,13 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) 
	    nf_reject_fill_skb_dst(skb_in) < 0)

		return;



	if (skb_csum_unnecessary(skb_in) || !nf_reject_verify_csum(proto)) {

	if (skb_csum_unnecessary(skb_in) ||

	    !nf_reject_verify_csum(skb_in, dataoff, proto)) {

		icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);

		return;

	}



	if (nf_ip_checksum(skb_in, hook, ip_hdrlen(skb_in), proto) == 0)

	if (nf_ip_checksum(skb_in, hook, dataoff, proto) == 0)

		icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);

}

EXPORT_SYMBOL_GPL(nf_send_unreach);

net/ipv6/netfilter/nf_reject_ipv6.c

+2 −2
Original line number Diff line number Diff line
@@ -31,7 +31,7 @@ static bool nf_reject_v6_csum_ok(struct sk_buff *skb, int hook) 
	if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)

		return false;



	if (!nf_reject_verify_csum(proto))

	if (!nf_reject_verify_csum(skb, thoff, proto))

		return true;



	return nf_ip6_checksum(skb, hook, thoff, proto) == 0;
@@ -388,7 +388,7 @@ static bool reject6_csum_ok(struct sk_buff *skb, int hook) 
	if (thoff < 0 || thoff >= skb->len || (fo & htons(~0x7)) != 0)

		return false;



	if (!nf_reject_verify_csum(proto))

	if (!nf_reject_verify_csum(skb, thoff, proto))

		return true;



	return nf_ip6_checksum(skb, hook, thoff, proto) == 0;