Git-Mirrors/qubes-mirage-firewall
1
0
Fork 0
mirror of https://github.com/mirage/qubes-mirage-firewall.git synced 2025-02-05 18:05:30 -05:00
Code Issues Packages Projects Releases Wiki Activity

Calculate checksums even for Accept action

Browse Source 
If packet has been NAT'd then we certainly need to recalculate the checksum,
but even for direct pass-through it might have been received with an invalid
checksum due to checksum offload. For now, recalculate full checksum in all
cases.

See #1.
This commit is contained in:
Thomas Leonard 2016-01-03 14:14:00 +00:00
parent 96bc12c591
commit 491dbd9323
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
firewall.ml
View File

@ -10,13 +10,18 @@ module Log = (val Logs.src_log src : Logs.LOG)
(* Transmission *)
let transmit ~frame iface =
(* If packet has been NAT'd then we certainly need to recalculate the checksum,
but even for direct pass-through it might have been received with an invalid
checksum due to checksum offload. For now, recalculate full checksum in all
cases. *)
let frame = fixup_checksums frame |> Cstruct.concat in
let packet = Cstruct.shift frame Wire_structs.sizeof_ethernet in
iface#writev [packet]
let forward_ipv4 t frame =
let packet = Cstruct.shift frame Wire_structs.sizeof_ethernet in
match Router.target t packet with
| Some iface -> iface#writev [packet]
| Some iface -> transmit ~frame iface
| None -> return ()
(* Packet classification *)
@ -71,9 +76,7 @@ let pp_packet fmt {src; dst; proto; frame = _} =
(* NAT *)
let translate t frame =
match Nat_rewrite.translate t.Router.nat frame with
| None -> None
| Some frame -> Some (fixup_checksums frame |> Cstruct.concat)
Nat_rewrite.translate t.Router.nat frame
let random_user_port () =
1024 + Random.int (0xffff - 1024)