diff mbox series

netfilter: flowtable: fix tcp and udp header checksum update

Message ID 20210202170116.8763-1-sven.auhagen@voleatech.de
State Accepted
Delegated to: Pablo Neira
Headers show
Series netfilter: flowtable: fix tcp and udp header checksum update | expand

Commit Message

Sven Auhagen Feb. 2, 2021, 5:01 p.m. UTC 
From: Sven Auhagen <sven.auhagen@voleatech.de>

When updating the tcp or udp header checksum on port nat
the function inet_proto_csum_replace2 with the last parameter
pseudohdr as true.
This leads to an error in the case that GRO is used and packets
are split up in GSO.
The tcp or udp checksum of all packets is incorrect.

The error is probably masked due to the fact the most network driver
implement tcp/udp checksum offloading.
It also only happens when GRO is applied and not on single packets.

The error is most visible when using a pppoe connection which is not
triggering the tcp/udp checksum offload.

Signed-off-by: Sven Auhagen <sven.auhagen@voleatech.de>

Comments

Pablo Neira Ayuso Feb. 2, 2021, 11:29 p.m. UTC | #1 
Hi Sven,

On Tue, Feb 02, 2021 at 06:01:16PM +0100, sven.auhagen@voleatech.de wrote:
> From: Sven Auhagen <sven.auhagen@voleatech.de>
> 
> When updating the tcp or udp header checksum on port nat
> the function inet_proto_csum_replace2 with the last parameter
> pseudohdr as true.
> This leads to an error in the case that GRO is used and packets
> are split up in GSO.
> The tcp or udp checksum of all packets is incorrect.
> 
> The error is probably masked due to the fact the most network driver
> implement tcp/udp checksum offloading.
> It also only happens when GRO is applied and not on single packets.
> 
> The error is most visible when using a pppoe connection which is not
> triggering the tcp/udp checksum offload.

Good catch.

I'll apply this patch to nf.git.
diff mbox series

Patch

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 513f78db3cb2..4a4acbba78ff 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -399,7 +399,7 @@  static int nf_flow_nat_port_tcp(struct sk_buff *skb, unsigned int thoff,
 		return -1;
 
 	tcph = (void *)(skb_network_header(skb) + thoff);
-	inet_proto_csum_replace2(&tcph->check, skb, port, new_port, true);
+	inet_proto_csum_replace2(&tcph->check, skb, port, new_port, false);
 
 	return 0;
 }
@@ -415,7 +415,7 @@  static int nf_flow_nat_port_udp(struct sk_buff *skb, unsigned int thoff,
 	udph = (void *)(skb_network_header(skb) + thoff);
 	if (udph->check || skb->ip_summed == CHECKSUM_PARTIAL) {
 		inet_proto_csum_replace2(&udph->check, skb, port,
-					 new_port, true);
+					 new_port, false);
 		if (!udph->check)
 			udph->check = CSUM_MANGLED_0;
 	}