[NETFILTER]: Fix ipt_REJECT udp checksums.

diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 10c1690a27172f948bf2408e8a5adff8d4521513..83181dbaa8e70205d9c3d8208246c54724883808 100644 (file)
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -6,6 +6,8 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/icmp.h>
 #include <net/icmp.h>
 #include <net/ip.h>
 #include <net/tcp.h>
@@ -164,6 +166,7 @@ static void send_reset(struct sk_buff *oldskb, int local)
 static void send_unreach(struct sk_buff *skb_in, int code)
 {
        struct iphdr *iph;
+       struct udphdr *udph;
        struct icmphdr *icmph;
        struct sk_buff *nskb;
        u32 saddr;
@@ -193,6 +196,19 @@ static void send_unreach(struct sk_buff *skb_in, int code)
        if (iph->frag_off&htons(IP_OFFSET))
                return;
 
+       /* if UDP checksum is set, verify it's correct */
+       if (iph->protocol == IPPROTO_UDP
+           && skb_in->tail-(u8*)iph >= sizeof(struct udphdr)) {
+               int datalen = skb_in->len - (iph->ihl<<2);
+               udph = (struct udphdr *)((char *)iph + (iph->ihl<<2));
+               if (udph->check
+                   && csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                        datalen, IPPROTO_UDP,
+                                        csum_partial((char *)udph, datalen,
+                                                     0)) != 0)
+                       return;
+       }
+                   
        /* If we send an ICMP error to an ICMP error a mess would result.. */
        if (iph->protocol == IPPROTO_ICMP
            && skb_in->tail-(u8*)iph >= sizeof(struct icmphdr)) {