From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH next] netfilter: reject: don't send icmp error if packet has invalid checksum
Date: Thu, 29 Jan 2015 11:21:57 +0100 [thread overview]
Message-ID: <20150129102157.GB5794@salvia> (raw)
In-Reply-To: <1422525586-9760-1-git-send-email-fw@strlen.de>
On Thu, Jan 29, 2015 at 10:59:46AM +0100, Florian Westphal wrote:
> tcp resets are never emitted if the packet that triggers the
> reject/reset has an invalid checksum.
>
> For icmp error responses there was no such check.
> It allows to distinguish icmp response generated via
>
> iptables -I INPUT -p udp --dport 42 -j REJECT
>
> and those emitted by network stack (won't respond if csum is invalid,
> REJECT does).
>
> Arguably its possible to avoid this by using conntrack and only using
> REJECT with -m conntrack NEW/RELATED.
>
> However, this doesn't work when connection tracking is not in use or
> when using nf_conntrack_checksum=0.
>
> Furthermore, sending errors in response to invalid csums doesn't make
> much sense so just add similar test as in nf_send_reset.
Could you also review net/bridge/netfilter/nft_reject_bridge.c?
Thanks.
next prev parent reply other threads:[~2015-01-29 10:18 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-29 9:59 [PATCH next] netfilter: reject: don't send icmp error if packet has invalid checksum Florian Westphal
2015-01-29 10:21 ` Pablo Neira Ayuso [this message]
2015-01-29 10:36 ` Florian Westphal
2015-01-31 21:47 ` Florian Westphal
2015-02-11 15:01 ` Pablo Neira Ayuso
2015-02-11 15:16 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150129102157.GB5794@salvia \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.