Actions
Bug #760
closedUDPv4 checksum calc issue
Affected Versions:
Effort:
Difficulty:
Label:
Description
In IPv4, UDP checksums can be 0, which means they are not used. I've come across such packets, and we consider them to have an invalid csum.
From http://www.ietf.org/rfc/rfc768.txt:
If the computed checksum is zero, it is transmitted as all ones (the equivalent in one's complement arithmetic). An all zero transmitted checksum value means that the transmitter generated no checksum (for debugging or for higher level protocols that don't care).
It may be interesting to check that "csum would be 0, transmitted as 1's" case as well.
This doesn't (fully) apply to IPv6, as there UDP csums are mandatory.
Will provide pcap privately.
Updated by Anoop Saldanha almost 12 years ago
Updated by Victor Julien almost 12 years ago
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
Merged https://github.com/inliniac/suricata/pull/307, thanks!
Actions