On Sat, Jun 29, 2013 at 12:15:19AM +0800, Changli Gao wrote: > Checksum of an IPv6 UDP packet is mandatory. There is some discussion on this: http://tools.ietf.org/html/rfc6936 "The inability to use an IPv6 datagram with a zero UDP checksum has been found to be a real problem for certain classes of application, primarily tunnel applications." > --- > net/netfilter/nf_conntrack_proto_udp.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c > index 9d7721c..31dc854 100644 > --- a/net/netfilter/nf_conntrack_proto_udp.c > +++ b/net/netfilter/nf_conntrack_proto_udp.c > @@ -134,8 +134,15 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb, > } > > /* Packet with no checksum */ > - if (!hdr->check) > + if (!hdr->check) { > + if (pf == PF_INET6) { > + if (LOG_INVALID(net, IPPROTO_UDP)) > + nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL, > + "nf_ct_udp: bad UDP checksum "); > + return -NF_ACCEPT; > + } > return NF_ACCEPT; > + } > > /* Checksum invalid? Ignore. > * We skip checking packets on the outgoing path > -- > 1.7.9.5 > -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
