Checksum at INIT ACK.

Checksum at INIT ACK.

[Moohyoung KIM]

Dear all,

I am currently trying to make an association with otter vendor's system. but it is failed.
The engineer of peer side requests me to set checksum parameter into INIT Ack. message we sent.

Q1. is it possible to differently set checksum value for each associations on linux-sctp?
Q2-1. If it is possible to set checksum separately, how to set the flag either use or not?
Q2-2. If it is NOT possible, we MUST turn the checksum feature on for whole association? how to do that? I am using lksctp-1.0.10-7 on Linux 2.6.32-432 (RHEL6).

Thanks

Re: Checksum at INIT ACK.

[Michael Tuexen]

> On 13 May 2015, at 04:14, Moohyoung KIM <emusal@gmail.com> wrote:
> 
> Dear all,
> 
> I am currently trying to make an association with otter vendor's system. but it is failed.
> The engineer of peer side requests me to set checksum parameter into INIT Ack. message we sent.
> 
> Q1. is it possible to differently set checksum value for each associations on linux-sctp?
> Q2-1. If it is possible to set checksum separately, how to set the flag either use or not?
> Q2-2. If it is NOT possible, we MUST turn the checksum feature on for whole association? how to do that? I am using lksctp-1.0.10-7 on Linux 2.6.32-432 (RHEL6).
SCTP only uses CRC32c as the checksum and it is mandatory to use it. There is no
"checksum parameter" for negotiating it.
Does your peer still use the deprecated Adler32? It has been changed to CRC32c in
https://tools.ietf.org/html/rfc3309
The updated SCTP specification
https://tools.ietf.org/html/rfc4960
doesn't mention Adler32 anymore.

Best regards
Michael
> 
> Thanks--
> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

Re: Checksum at INIT ACK.

[Moohyoung KIM]

Thanks for your kind response

The root cause of this problem is probably lksctp that is included in Linux 2.6.32-432.
I found the lksctp that is included in Linux 2.6.32-504 is changed something related to checksum.
When using virtual IP on bonding interface as our configuration, old lksctp did not set checksum value into their header.

After installing kernel update that include new lksctp that this problem is patched, the checksum is successfully set.

Thanks   

2015. 5. 13., 오후 2:55, Michael Tuexen <Michael.Tuexen@lurchi.franken.de> 작성:

> On 13 May 2015, at 04:14, Moohyoung KIM <emusal@gmail.com> wrote:
> 
> Dear all,
> 
> I am currently trying to make an association with otter vendor's system. but it is failed.
> The engineer of peer side requests me to set checksum parameter into INIT Ack. message we sent.
> 
> Q1. is it possible to differently set checksum value for each associations on linux-sctp?
> Q2-1. If it is possible to set checksum separately, how to set the flag either use or not?
> Q2-2. If it is NOT possible, we MUST turn the checksum feature on for whole association? how to do that? I am using lksctp-1.0.10-7 on Linux 2.6.32-432 (RHEL6).
SCTP only uses CRC32c as the checksum and it is mandatory to use it. There is no
"checksum parameter" for negotiating it.
Does your peer still use the deprecated Adler32? It has been changed to CRC32c in
https://tools.ietf.org/html/rfc3309
The updated SCTP specification
https://tools.ietf.org/html/rfc4960
doesn't mention Adler32 anymore.

Best regards
Michael
> 
> Thanks--
> To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 



--
To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Checksum at INIT ACK.

[Daniel Borkmann]

On 05/13/2015 08:48 AM, Moohyoung KIM wrote:
> Thanks for your kind response
> 
> The root cause of this problem is probably lksctp that is included in Linux 2.6.32-432.
> I found the lksctp that is included in Linux 2.6.32-504 is changed something related to checksum.
> When using virtual IP on bonding interface as our configuration, old lksctp did not set checksum value into their header.
> 
> After installing kernel update that include new lksctp that this problem is patched, the checksum is successfully set.

I have no concrete overview on RHEL anymore, but I remember that there
was a bug when using SCTP over f.e. bonding which if I remember correctly
the commit below fixed (there are also some more recent ones doing the
same for xfrm):

commit b73c43f884b1b26ef8e824a33f3924f92e493c11
Author: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Date:   Wed Jul 13 14:10:29 2011 +0000

    net: sctp: fix checksum marking for outgoing packets

    Packets to devices without NETIF_F_SCTP_CSUM (including NETIF_F_NO_CSUM)
    should be properly checksummed because the packets can be diverted or
    rerouted after construction. This still leaves packets diverted from
    NETIF_F_SCTP_CSUM-enabled devices with broken checksums. Fixing this
    needs implementing software offload fallback in networking core.

    For users of sctp_checksum_disable, skb->ip_summed should be left as
    CHECKSUM_NONE and not CHECKSUM_UNNECESSARY as per include/linux/skbuff.h.

    Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
    Signed-off-by: David S. Miller <davem@davemloft.net>

That's why you most likely don't see this anymore on newer RHEL6.

> Thanks
> 
> 2015. 5. 13., 오후 2:55, Michael Tuexen <Michael.Tuexen@lurchi.franken.de> 작성:
> 
>> On 13 May 2015, at 04:14, Moohyoung KIM <emusal@gmail.com> wrote:
>>
>> Dear all,
>>
>> I am currently trying to make an association with otter vendor's system. but it is failed.
>> The engineer of peer side requests me to set checksum parameter into INIT Ack. message we sent.
>>
>> Q1. is it possible to differently set checksum value for each associations on linux-sctp?
>> Q2-1. If it is possible to set checksum separately, how to set the flag either use or not?
>> Q2-2. If it is NOT possible, we MUST turn the checksum feature on for whole association? how to do that? I am using lksctp-1.0.10-7 on Linux 2.6.32-432 (RHEL6).
> SCTP only uses CRC32c as the checksum and it is mandatory to use it. There is no
> "checksum parameter" for negotiating it.
> Does your peer still use the deprecated Adler32? It has been changed to CRC32c in
> https://tools.ietf.org/html/rfc3309
> The updated SCTP specification
> https://tools.ietf.org/html/rfc4960
> doesn't mention Adler32 anymore.
> 
> Best regards
> Michael

--
To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Checksum at INIT ACK.

[Moohyoung KIM]

Yes, we also found that bug during we was finding the root cause about empty checksum problem.
And then, our engineer compared the changes between current and the newest RHEL6 kernel source.
As you know, the implementation of lksctp is included in Linux kernel source.

Old lksctp that is included in 2.6.32-432 did not mark checksum flag for outgoing packets as you wrote below.
Therefore, the outgoing packet (INIT Ack) is delivered with empty checksum value and the association is silently discarded by peer.

Additionally, This problem is fixed from RHEL 6.6 (2.6.32-504)

Thanks

2015. 5. 13., 오후 4:53, Daniel Borkmann <daniel@iogearbox.net> 작성:

On 05/13/2015 08:48 AM, Moohyoung KIM wrote:
> Thanks for your kind response
> 
> The root cause of this problem is probably lksctp that is included in Linux 2.6.32-432.
> I found the lksctp that is included in Linux 2.6.32-504 is changed something related to checksum.
> When using virtual IP on bonding interface as our configuration, old lksctp did not set checksum value into their header.
> 
> After installing kernel update that include new lksctp that this problem is patched, the checksum is successfully set.

I have no concrete overview on RHEL anymore, but I remember that there
was a bug when using SCTP over f.e. bonding which if I remember correctly
the commit below fixed (there are also some more recent ones doing the
same for xfrm):

commit b73c43f884b1b26ef8e824a33f3924f92e493c11
Author: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Date:   Wed Jul 13 14:10:29 2011 +0000

   net: sctp: fix checksum marking for outgoing packets

   Packets to devices without NETIF_F_SCTP_CSUM (including NETIF_F_NO_CSUM)
   should be properly checksummed because the packets can be diverted or
   rerouted after construction. This still leaves packets diverted from
   NETIF_F_SCTP_CSUM-enabled devices with broken checksums. Fixing this
   needs implementing software offload fallback in networking core.

   For users of sctp_checksum_disable, skb->ip_summed should be left as
   CHECKSUM_NONE and not CHECKSUM_UNNECESSARY as per include/linux/skbuff.h.

   Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
   Signed-off-by: David S. Miller <davem@davemloft.net>

That's why you most likely don't see this anymore on newer RHEL6.

> Thanks
> 
> 2015. 5. 13., 오후 2:55, Michael Tuexen <Michael.Tuexen@lurchi.franken.de> 작성:
> 
>> On 13 May 2015, at 04:14, Moohyoung KIM <emusal@gmail.com> wrote:
>> 
>> Dear all,
>> 
>> I am currently trying to make an association with otter vendor's system. but it is failed.
>> The engineer of peer side requests me to set checksum parameter into INIT Ack. message we sent.
>> 
>> Q1. is it possible to differently set checksum value for each associations on linux-sctp?
>> Q2-1. If it is possible to set checksum separately, how to set the flag either use or not?
>> Q2-2. If it is NOT possible, we MUST turn the checksum feature on for whole association? how to do that? I am using lksctp-1.0.10-7 on Linux 2.6.32-432 (RHEL6).
> SCTP only uses CRC32c as the checksum and it is mandatory to use it. There is no
> "checksum parameter" for negotiating it.
> Does your peer still use the deprecated Adler32? It has been changed to CRC32c in
> https://tools.ietf.org/html/rfc3309
> The updated SCTP specification
> https://tools.ietf.org/html/rfc4960
> doesn't mention Adler32 anymore.
> 
> Best regards
> Michael



--
To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html