I am running an application that injects iptables connection tracking rules into the kernel so the machine can forward incoming UDP traffic to its destination as fast as possible.
Some of the traffic received on this machine is not quite according to spec and the receiving party is not always handling this traffic as it should. Unfortunately the sending hardware supplier says there's nothing wrong with what they're sending and the receiving party supplier says the sender should never send traffic like that, so I'm caught in the middle trying to solve a problem.
The server where I have full control over the traffic uses iptables connection tracking to forward the traffic from one sending party to the receiving party using input from another application. The offending traffic is easily recognizable, it is the only traffic using 0 length UDP payload being sent by the sending party.
How do I make sure my iptables rule dropping the offending traffic is being triggered before conntrack forwards the UDP messages?
iptables -A INPUT -p udp --dport 50000:60000 -m length --length 8 -j DROP doesn't work, the packets still flow through the machine. I also tried with a length of 8 (the UDP header size) but the result is the same.