| Message ID | 1444140652.14655.340.camel@sakura.staff.proxad.net |
|---|---|
| State | Awaiting Upstream, archived |
| Delegated to: | David Miller |
| Headers | show |
On Tue, Oct 06, 2015 at 04:10:52PM +0200, Maxime Bizon wrote: > > With this setup: > > * non IPv6 checksumming capable network hardware > * GRO off > * IPv6 SNAT > > I get this when I receive an UDPv6 reply: "<unknown>: hw csum failure" > > Call trace: > > * nf_ip6_checksum() calls __skb_checksum_complete() > * nf_nat_ipv6_csum_update() & nf_nat_ipv6_manip_pkt() > * __udp6_lib_rcv() => udp6_csum_init() > * __skb_checksum_validate_complete() "fastpath" fails because > skb->csum is incorrect. > * udpv6_recvmsg() => skb_copy_and_csum_datagram_msg() > > The last call computes a valid checksum despite CHECKSUM_COMPLETE and > triggers the warning. > > When we perform NAT on IPv4, we also update the IPv4 checksum, so > there is no side effect on skb->csum (since the csum over a valid IPv4 > header area is zero). > > But IPv6 doesn't have such header checksum, so when performing NAT we need to > update skb->csum. Please, resubmit and Cc netfilter-devel@vger.kernel.org. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c index 70fbaed..e9917d74 100644 --- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c @@ -81,6 +81,8 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb, enum nf_nat_manip_type maniptype) { struct ipv6hdr *ipv6h; + const __be32 *to; + __be32 *from; __be16 frag_off; int hdroff; u8 nexthdr; @@ -100,11 +102,24 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb, target, maniptype)) return false; manip_addr: - if (maniptype == NF_NAT_MANIP_SRC) - ipv6h->saddr = target->src.u3.in6; - else - ipv6h->daddr = target->dst.u3.in6; + if (maniptype == NF_NAT_MANIP_SRC) { + from = ipv6h->saddr.s6_addr32; + to = target->src.u3.in6.s6_addr32; + } else { + from = ipv6h->daddr.s6_addr32; + to = target->src.u3.in6.s6_addr32; + } + + if (skb->ip_summed == CHECKSUM_COMPLETE) { + __be32 diff[] = { + ~from[0], ~from[1], ~from[2], ~from[3], + to[0], to[1], to[2], to[3], + }; + + skb->csum = ~csum_partial(diff, sizeof(diff), ~skb->csum); + } + memcpy(from, to, sizeof (struct in6_addr)); return true; }
With this setup: * non IPv6 checksumming capable network hardware * GRO off * IPv6 SNAT I get this when I receive an UDPv6 reply: "<unknown>: hw csum failure" Call trace: * nf_ip6_checksum() calls __skb_checksum_complete() * nf_nat_ipv6_csum_update() & nf_nat_ipv6_manip_pkt() * __udp6_lib_rcv() => udp6_csum_init() * __skb_checksum_validate_complete() "fastpath" fails because skb->csum is incorrect. * udpv6_recvmsg() => skb_copy_and_csum_datagram_msg() The last call computes a valid checksum despite CHECKSUM_COMPLETE and triggers the warning. When we perform NAT on IPv4, we also update the IPv4 checksum, so there is no side effect on skb->csum (since the csum over a valid IPv4 header area is zero). But IPv6 doesn't have such header checksum, so when performing NAT we need to update skb->csum. Signed-off-by: Maxime Bizon <mbizon@freebox.fr> --- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-)