Re: iptables breakage WAS(Re: dummy as IMQ replacement

[Patrick McHardy <kaber@trash.net>]

jamal wrote:
> At the moment it is expected the user will only direct IP packets at
> ipt. Note, however - desire is not to just stick to iptables
> but rather also accept arp packets and use targets arptables has etc. 
> In such cases it will be important that checks are made.
> Even in this case though -there will be target which probably wont care
> if i gave them a decnet packet or IP - example mark. Is this correct? I
> can understand when headers are to be mucked with.

That is correct.

> in regards to tracking:
> We will have actions that will do all those validations - but the choice
> will be upto the users policy. Will tracking have issues if i passed it
> a packet that didnt have the correct checksum?

No, it might (TCP) simply ignore them. NAT usually does incremental
checksumming, except for ICMP errors. As for validation - I think we
have two things, necessary validations, these can't be optional,
and useless validations, since they are not necessary :) TCP checksum
for example would be useless, since everything in iptables that cares
about it needs to verify it itself anyway.

>>Both assume the length checks in ip_rcv() have been
>>performed, it actually creates security problems in a few places if
>>they haven't - length calculations can underflow and bad things will
>>happen.
> 
> I havent really stared at the contrack code - If i ask it to track for
> me though, would it have issues?
> Recall that the packets at the two tc spots (ingress/egress) already
> have their skb pointers in the right spots.

It will try to track. The problematic spots are length calculations,
it is assumed that skb->len == iph->ihl*4.

Regards
Patrick