Where in the graph to discard malformed L4 packets?

[Morten Brørup]

Let's say a received TCP packet is malformed, e.g. has SYN,FIN flags.

Should we discard it early? E.g. in ip_input and ip6input.

Or should all L4 processing modules check and discard? They could use a shared lib for this.

The packet may be malformed in a more elaborate way, e.g. malformed TCP options, which requires more processing to detect.


For a more advanced example...
A valid ICMP packet, e.g. TTL Exceeded, containing a malformed IP/TCP packet in the ICMP payload.


Venlig hilsen / Kind regards,
-Morten Brørup