nftables payload statements are used to mangle SCTP headers, but they can only replace the Internet Checksum. As a consequence, nftables rules that mangle sport/dport/vtag in SCTP headers potentially generate packets that are discarded by the receiver, unless the CRC-32C is "offloaded" (e.g the rule mangles a skb having 'ip_summed' equal to 'CHECKSUM_PARTIAL'. Fix this extending uAPI definitions and L4 checksum update function, in a way that userspace programs (e.g. nft) can instruct the kernel to compute CRC-32C in SCTP headers. Also ensure that LIBCRC32C is built if NF_TABLES is 'y' or 'm' in the kernel build configuration.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -749,10 +749,12 @@ enum nft_payload_bases { · 748 unmodified lines | |||
| 749 | * | 749 | * |
| 750 | * @NFT_PAYLOAD_CSUM_NONE: no checksumming | 750 | * @NFT_PAYLOAD_CSUM_NONE: no checksumming |
| 751 | * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791) | 751 | * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791) |
| 752 | * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309) | ||
| 752 | */ | 753 | */ |
| 753 | enum nft_payload_csum_types { | 754 | enum nft_payload_csum_types { |
| 754 | NFT_PAYLOAD_CSUM_NONE, | 755 | NFT_PAYLOAD_CSUM_NONE, |
| 755 | NFT_PAYLOAD_CSUM_INET, | 756 | NFT_PAYLOAD_CSUM_INET, |
| 757 | NFT_PAYLOAD_CSUM_SCTP, | ||
| 756 | }; | 758 | }; |
| 757 | 759 | ||
| 758 | enum nft_payload_csum_flags { | 760 | enum nft_payload_csum_flags { |