From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Davide Caratti <dcaratti@redhat.com>
Cc: Patrick McHardy <kaber@trash.net>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
"David S . Miller" <davem@davemloft.net>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org
Subject: Re: [PATCH nf-next 0/2] nf_conntrack: validate crc32c on SCTP packets hitting PREROUTING hook
Date: Thu, 5 Jan 2017 13:25:13 +0100 [thread overview]
Message-ID: <20170105122513.GA6237@salvia> (raw)
In-Reply-To: <cover.1483355460.git.dcaratti@redhat.com>
On Mon, Jan 02, 2017 at 01:29:39PM +0100, Davide Caratti wrote:
> unlike what happens with other protcols, conntrack entries are matched by
> SCTP packets even when crc32c is incorrect. Moreover, netfilter 'REJECT'
> target does not generate any ICMP on reception of SCTP packets, because it
> computes RFC 1624 checksum ad compares it with crc32c in the transport
> header, resulting in a systematic mismatch.
>
> The above issues can be resolved by implementing .error() callback in SCTP
> conntrack helper. Patch 1 of this series lets LIBCRC32C be selected with
> NF_CT_PROTO_SCTP, to allow crc32c validation within nf_conntrack. Patch 2
> implements .error() callback in nf_conntrack_l4proto_sctp{4,6}: like other
> protocols do with the Internet Checksum, sctp_error() validates crc32c in
> PREROUTING hook, updates the value of skb->ip_summed and returns the result
> of checksum validation to let conntrack core skip corrupted packets.
Series applied, thanks Davide.
prev parent reply other threads:[~2017-01-05 12:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-01-02 12:29 [PATCH nf-next 0/2] nf_conntrack: validate crc32c on SCTP packets hitting PREROUTING hook Davide Caratti
2017-01-02 12:29 ` [PATCH nf-next 1/2] netfilter: select LIBCRC32C together with SCTP conntrack Davide Caratti
2017-01-02 19:10 ` Marcelo Ricardo Leitner
2017-01-02 12:29 ` [PATCH nf-next 2/2] netfilter: conntrack: validate SCTP crc32c in PREROUTING Davide Caratti
2017-01-05 12:25 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170105122513.GA6237@salvia \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=dcaratti@redhat.com \
--cc=kaber@trash.net \
--cc=kadlec@blackhole.kfki.hu \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.