From: Antonio Quartulli <[email protected]> As per RFC768, when the UDP checksum is zero, it means it was not computed by the source, therefore any NAT processing along the way should leave the checksum alone and not update it. Failing to do so would result in computing a bogus value.
At the same time, if the result of updating a non-zero checksum ends up being zero, as per the same RFC, we must store its one-complement (0xFFFF) as zero is reserved for "checksum not computed", as mentioned above. Ensure our Client NAT code follows both rules. Github: closes OpenVPN/openvpn#1037 Reported-by: Jeff Salee <[email protected]> Change-Id: I4068bf8175c23151298d142dc920ab89f861a411 Signed-off-by: Antonio Quartulli <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1681 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1681 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru <[email protected]> diff --git a/src/openvpn/clinat.c b/src/openvpn/clinat.c index 32c1325..3724022 100644 --- a/src/openvpn/clinat.c +++ b/src/openvpn/clinat.c @@ -258,7 +258,23 @@ { if (BLENZ(ipbuf) >= sizeof(struct openvpn_iphdr) + sizeof(struct openvpn_udphdr)) { - ADJUST_CHECKSUM(accumulate, h->u.udp.check); + /* RFC 768: a UDP checksum of 0 means "no checksum computed". + * Do not run the incremental adjustment over a non-checksum, + * or we will write a bogus non-zero value into the field. + */ + if (h->u.udp.check) + { + ADJUST_CHECKSUM(accumulate, h->u.udp.check); + + if (!h->u.udp.check) + { + /* RFC 768: a computed checksum of 0 must be transmitted + * as 0xFFFF (one-complement), because 0 is reserved for + * "no checksum computed" + */ + h->u.udp.check = 0xFFFF; + } + } } } } _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
