netdev - Re: [PATCH net-next] netfilter: nftables: allow re-computing sctp CRC-32C in 'payload' statements

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201015115439.7791c3f9@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Date:   Thu, 15 Oct 2020 11:54:39 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Pablo Neira Ayuso <pablo@...filter.org>
Cc:     netfilter-devel@...r.kernel.org, davem@...emloft.net,
        netdev@...r.kernel.org
Subject: Re: [PATCH net-next] netfilter: nftables: allow re-computing sctp
 CRC-32C in 'payload' statements

On Thu, 15 Oct 2020 18:39:27 +0200 Pablo Neira Ayuso wrote:
> From: Davide Caratti <dcaratti@...hat.com>
> 
> nftables payload statements are used to mangle SCTP headers, but they can
> only replace the Internet Checksum. As a consequence, nftables rules that
> mangle sport/dport/vtag in SCTP headers potentially generate packets that
> are discarded by the receiver, unless the CRC-32C is "offloaded" (e.g the
> rule mangles a skb having 'ip_summed' equal to 'CHECKSUM_PARTIAL'.
> 
> Fix this extending uAPI definitions and L4 checksum update function, in a
> way that userspace programs (e.g. nft) can instruct the kernel to compute
> CRC-32C in SCTP headers. Also ensure that LIBCRC32C is built if NF_TABLES
> is 'y' or 'm' in the kernel build configuration.
> 
> Signed-off-by: Davide Caratti <dcaratti@...hat.com>
> Signed-off-by: Florian Westphal <fw@...len.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@...filter.org>
> ---
> @Jakub: This is my last pending item in nf-next I think, I'm not planning to
> 	send a pull request for a single patch, so please directly apply this
> 	one to net-next. Thank you.

Applied, thanks!