[Bug 1742] using nfqueue breaks SCTP connection (tracking)

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1742

--- Comment #3 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Pablo Neira Ayuso from comment #2)
> (In reply to Antonio Ojea from comment #1)
> > As a workaround, if I set the flag NFQA_CFG_F_GSO then the packet is not
> > modified and connection works perfectly (I´m only using nfqueue for dropping)

Workaround makes sense, because branch depends on NFQA_CFG_F_GSO flag:

        case NFQNL_COPY_PACKET:
                if (!(queue->flags & NFQA_CFG_F_GSO) &&
                    entskb->ip_summed == CHECKSUM_PARTIAL &&
                    skb_checksum_help(entskb))
                        return NULL;

if set on, the checksum calculation is skipped.

For filtering (only dropping), enabling NFQA_CFG_F_GSO makes perfect sense
(unless your heuristic is based on the real packet as seen in the wire, that
is, GRO does not interference with the filtering criteria)

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20240407/2005a6a7/attachment.html>