| Message ID | 20240421142234.15764-1-iluceno@suse.de (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v2] ipvs: Fix checksumming on GSO of SCTP packets | expand |
Hello, On Sun, 21 Apr 2024, Ismael Luceno wrote: > It was observed in the wild that pairs of consecutive packets would leave > the IPVS with the same wrong checksum, and the issue only went away when > disabling GSO. > > IPVS needs to avoid computing the SCTP checksum when using GSO. > > Fixes: 90017accff61 ("sctp: Add GSO support", 2016-06-02) > Co-developed-by: Firo Yang <firo.yang@suse.com> > Signed-off-by: Ismael Luceno <iluceno@suse.de> > Tested-by: Andreas Taschner <andreas.taschner@suse.com> > CC: Michal Kubeček <mkubecek@suse.com> > CC: Simon Horman <horms@verge.net.au> > CC: Julian Anastasov <ja@ssi.bg> > CC: lvs-devel@vger.kernel.org > CC: netfilter-devel@vger.kernel.org > CC: netdev@vger.kernel.org > CC: coreteam@netfilter.org Looks good to me, thanks! Acked-by: Julian Anastasov <ja@ssi.bg> As scripts/checkpatch.pl --strict /tmp/file.patch complains about Co-developed-by and Signed-off-by lines you may want to send v3... > --- > > Notes: > Changes since v1: > * Added skb_is_gso before skb_is_gso_sctp. > * Added "Fixes" tag. > > net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c > index a0921adc31a9..1e689c714127 100644 > --- a/net/netfilter/ipvs/ip_vs_proto_sctp.c > +++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c > @@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > if (sctph->source != cp->vport || payload_csum || > skb->ip_summed == CHECKSUM_PARTIAL) { > sctph->source = cp->vport; > - sctp_nat_csum(skb, sctph, sctphoff); > + if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) > + sctp_nat_csum(skb, sctph, sctphoff); > } else { > skb->ip_summed = CHECKSUM_UNNECESSARY; > } > @@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > (skb->ip_summed == CHECKSUM_PARTIAL && > !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { > sctph->dest = cp->dport; > - sctp_nat_csum(skb, sctph, sctphoff); > + if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) > + sctp_nat_csum(skb, sctph, sctphoff); > } else if (skb->ip_summed != CHECKSUM_PARTIAL) { > skb->ip_summed = CHECKSUM_UNNECESSARY; > } > -- > 2.43.0 Regards -- Julian Anastasov <ja@ssi.bg>
On Sun, Apr 21, 2024 at 04:22:32PM +0200, Ismael Luceno wrote: > It was observed in the wild that pairs of consecutive packets would leave > the IPVS with the same wrong checksum, and the issue only went away when > disabling GSO. > > IPVS needs to avoid computing the SCTP checksum when using GSO. I am placing this into the nf.git tree for submission upstream in the next pull request, unless stated otherwise. Thanks. > Fixes: 90017accff61 ("sctp: Add GSO support", 2016-06-02) > Co-developed-by: Firo Yang <firo.yang@suse.com> > Signed-off-by: Ismael Luceno <iluceno@suse.de> > Tested-by: Andreas Taschner <andreas.taschner@suse.com> > CC: Michal Kubeček <mkubecek@suse.com> > CC: Simon Horman <horms@verge.net.au> > CC: Julian Anastasov <ja@ssi.bg> > CC: lvs-devel@vger.kernel.org > CC: netfilter-devel@vger.kernel.org > CC: netdev@vger.kernel.org > CC: coreteam@netfilter.org > --- > > Notes: > Changes since v1: > * Added skb_is_gso before skb_is_gso_sctp. > * Added "Fixes" tag. > > net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c > index a0921adc31a9..1e689c714127 100644 > --- a/net/netfilter/ipvs/ip_vs_proto_sctp.c > +++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c > @@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > if (sctph->source != cp->vport || payload_csum || > skb->ip_summed == CHECKSUM_PARTIAL) { > sctph->source = cp->vport; > - sctp_nat_csum(skb, sctph, sctphoff); > + if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) > + sctp_nat_csum(skb, sctph, sctphoff); > } else { > skb->ip_summed = CHECKSUM_UNNECESSARY; > } > @@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, > (skb->ip_summed == CHECKSUM_PARTIAL && > !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { > sctph->dest = cp->dport; > - sctp_nat_csum(skb, sctph, sctphoff); > + if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) > + sctp_nat_csum(skb, sctph, sctphoff); > } else if (skb->ip_summed != CHECKSUM_PARTIAL) { > skb->ip_summed = CHECKSUM_UNNECESSARY; > } > -- > 2.43.0 > >
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c index a0921adc31a9..1e689c714127 100644 --- a/net/netfilter/ipvs/ip_vs_proto_sctp.c +++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c @@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, if (sctph->source != cp->vport || payload_csum || skb->ip_summed == CHECKSUM_PARTIAL) { sctph->source = cp->vport; - sctp_nat_csum(skb, sctph, sctphoff); + if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) + sctp_nat_csum(skb, sctph, sctphoff); } else { skb->ip_summed = CHECKSUM_UNNECESSARY; } @@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, (skb->ip_summed == CHECKSUM_PARTIAL && !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { sctph->dest = cp->dport; - sctp_nat_csum(skb, sctph, sctphoff); + if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) + sctp_nat_csum(skb, sctph, sctphoff); } else if (skb->ip_summed != CHECKSUM_PARTIAL) { skb->ip_summed = CHECKSUM_UNNECESSARY; }
It was observed in the wild that pairs of consecutive packets would leave the IPVS with the same wrong checksum, and the issue only went away when disabling GSO. IPVS needs to avoid computing the SCTP checksum when using GSO. Fixes: 90017accff61 ("sctp: Add GSO support", 2016-06-02) Co-developed-by: Firo Yang <firo.yang@suse.com> Signed-off-by: Ismael Luceno <iluceno@suse.de> Tested-by: Andreas Taschner <andreas.taschner@suse.com> CC: Michal Kubeček <mkubecek@suse.com> CC: Simon Horman <horms@verge.net.au> CC: Julian Anastasov <ja@ssi.bg> CC: lvs-devel@vger.kernel.org CC: netfilter-devel@vger.kernel.org CC: netdev@vger.kernel.org CC: coreteam@netfilter.org --- Notes: Changes since v1: * Added skb_is_gso before skb_is_gso_sctp. * Added "Fixes" tag. net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)