Subject: Re: [RFT] nf_contrack_udp: handle packets with padding and hwchecksum

From: Pablo Neira Ayuso <[email-masked]>
Date: Tue, 21 Feb 2012 13:19:11 +0100

Hi Stephen,

On Fri, Feb 17, 2012 at 10:16:48AM -0800, Stephen Hemminger wrote:
> If UDP packet with extra padding is received on a device that
> does hardware checksumming (but not checking) is processed
> by netfilter conntrack, it would generate a bogus warning
> about the checksum being incorrect.
> 
> There were two possible solutions. The netfilter conntrack
> code could trim the packet, discarding the extra padding
> and adjusting the checksum. Or it can force regular
> non-offloaded checksum. This patch implements the latter
> on the principal that is better for firewall code to not
> modify the packet.

I like this approach.

> Compile tested only; haven't been able to reproduce the
> problem yet.

Let me know if I should pass this to davem once you confirm this fixes
the problem you're noticing.