7fc3822536
Some protocols have other means to verify the payload integrity (AH, ESP, SCTP) while others are incompatible with nf_ip(6)_checksum implementation because checksum is either optional or might be partial (UDPLITE, DCCP, GRE). Because nf_ip(6)_checksum was used to validate the packets, ip(6)tables REJECT rules were not capable to generate ICMP(v6) errors for the protocols mentioned above. This commit also fixes the incorrect pseudo-header protocol used for IPv4 packets that carry other transport protocols than TCP or UDP (pseudo-header used protocol 0 iso the proper value). Signed-off-by: Alin Nastac <alin.nastac@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
28 lines
576 B
C
28 lines
576 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _NF_REJECT_H
|
|
#define _NF_REJECT_H
|
|
|
|
static inline bool nf_reject_verify_csum(__u8 proto)
|
|
{
|
|
/* Skip protocols that don't use 16-bit one's complement checksum
|
|
* of the entire payload.
|
|
*/
|
|
switch (proto) {
|
|
/* Protocols with other integrity checks. */
|
|
case IPPROTO_AH:
|
|
case IPPROTO_ESP:
|
|
case IPPROTO_SCTP:
|
|
|
|
/* Protocols with partial checksums. */
|
|
case IPPROTO_UDPLITE:
|
|
case IPPROTO_DCCP:
|
|
|
|
/* Protocols with optional checksums. */
|
|
case IPPROTO_GRE:
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
#endif /* _NF_REJECT_H */
|