netfilter: conntrack: skip verification of zero UDP checksum

Browse source

The checksum is optional for UDP packets. However nf_reject would
previously require a valid checksum to elicit a response such as
ICMP_DEST_UNREACH.

Add some logic to nf_reject_verify_csum to determine if a UDP packet has
a zero checksum and should therefore not be verified.

Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Kevin Mitchell 2022-04-29 20:40:27 -07:00 • committed by Pablo Neira Ayuso

parent 3412e16418

commit 4f9bd53084

3 changed files with 26 additions and 9 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

21

include/net/netfilter/nf_reject.h

View file