unlike what happens with other protcols, conntrack entries are matched by
SCTP packets even when crc32c is incorrect. Moreover, netfilter 'REJECT'
target does not generate any ICMP on reception of SCTP packets, because it
computes RFC 1624 checksum ad compares it with crc32c in the transport
header, resulting in a systematic mismatch.
The above issues can be resolved by implementing .error() callback in SCTP
conntrack helper. Patch 1 of this series lets LIBCRC32C be selected with
NF_CT_PROTO_SCTP, to allow crc32c validation within nf_conntrack. Patch 2
implements .error() callback in nf_conntrack_l4proto_sctp{4,6}: like other
protocols do with the Internet Checksum, sctp_error() validates crc32c in
PREROUTING hook, updates the value of skb->ip_summed and returns the result
of checksum validation to let conntrack core skip corrupted packets.
Davide Caratti (2):
netfilter: select LIBCRC32C together with SCTP conntrack
netfilter: conntrack: validate SCTP crc32c in PREROUTING
net/netfilter/Kconfig | 2 +-
net/netfilter/nf_conntrack_proto_sctp.c | 32 ++++++++++++++++++++++++++++++++
2 files changed, 33 insertions(+), 1 deletion(-)
--
2.7.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
