Where in the graph to discard malformed L4 packets?

[Robin Jarry]

Hey Morten,

Morten Brørup, Aug 28, 2026 at 20:17:
> Let's say a received TCP packet is malformed, e.g. has SYN,FIN flags.
>
> Should we discard it early? E.g. in ip_input and ip6input.

As early as possibly without lookahead. E.g. if the TCP packet is just
forwarded, grout should only access up to the IP header so it would have
no way to determine whether the packet is valid or not.

However, if there is dynamic SNAT involved, we need to read the TCP
packet to create the appropriate connection tracking object. At this
point we would be able to detect malformed TCP headers. I have looked at
the conntrack code and we don't discard invalid TCP flags combinations
at the moment.

We may need to reconsider this if/when we add ACL/firewall support.

> Or should all L4 processing modules check and discard? They could use
> a shared lib for this.

This would find its place in the policy module, in conntrack.{ch}.

> The packet may be malformed in a more elaborate way, e.g. malformed
> TCP options, which requires more processing to detect.
>
> For a more advanced example... A valid ICMP packet, e.g. TTL Exceeded,
> containing a malformed IP/TCP packet in the ICMP payload.

Why would you want to do anything if the *payload* of an ICMP error is
malformed?

-- 
Robin

# If you suspect that this message may have been intercepted or amended,
# please call the sender.