Where in the graph to discard malformed L4 packets?

[Morten Brørup]

> From: Robin Jarry [mailto:rjarry at redhat.com]
> Sent: Sunday, 30 August 2026 16.41
> 
> Hey Morten,
> 
> Morten Brørup, Aug 28, 2026 at 20:17:
> > Let's say a received TCP packet is malformed, e.g. has SYN,FIN flags.
> >
> > Should we discard it early? E.g. in ip_input and ip6input.
> 
> As early as possibly without lookahead. E.g. if the TCP packet is just
> forwarded, grout should only access up to the IP header so it would
> have
> no way to determine whether the packet is valid or not.

OK. Very clear guidance! Thank you.

> 
> However, if there is dynamic SNAT involved, we need to read the TCP
> packet to create the appropriate connection tracking object. At this
> point we would be able to detect malformed TCP headers.

OK.

> I have looked at
> the conntrack code and we don't discard invalid TCP flags combinations
> at the moment.

I'm currently working on conntrack, and already implemented handling of invalid TCP flags combinations.

> 
> We may need to reconsider this if/when we add ACL/firewall support.
> 
> > Or should all L4 processing modules check and discard? They could use
> > a shared lib for this.
> 
> This would find its place in the policy module, in conntrack.{ch}.

Makes sense.
Clear guidance again, thank you.

> 
> > The packet may be malformed in a more elaborate way, e.g. malformed
> > TCP options, which requires more processing to detect.
> >
> > For a more advanced example... A valid ICMP packet, e.g. TTL
> Exceeded,
> > containing a malformed IP/TCP packet in the ICMP payload.
> 
> Why would you want to do anything if the *payload* of an ICMP error is
> malformed?

Some ICMP error packets carry the offending packet as payload.
Processing this might be needed for NAT. I'm not sure.
I thought it was a good example of a packet that was malformed in an exotic way.

BTW, I'm also working on IP reassembly.

NAT of fragments requires storing the L4 header from the first fragment as metadata in the non-first fragments, and holding back all non-first fragments until their first fragment has been received (and the L4 header can be obtained).
It seems easier to reassemble IP fragments on input and only have to deal with complete IP packets in the following nodes, so that is the approach I'm taking with Grout.