* ftp ipvs connect failed in ipv6 @ 2025-02-10 13:06 mengkanglai 2025-02-11 13:55 ` Julian Anastasov 0 siblings, 1 reply; 4+ messages in thread From: mengkanglai @ 2025-02-10 13:06 UTC (permalink / raw) To: Pablo Neira Ayuso, Jozsef Kadlecsik, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Yanan (Euler), Fengtao (fengtao, Euler), gaoxingwang (A) Hello: I found a problem with ftp ipvs. I create 3 virtual machine in one host. One is the FTP client, the other is the ipvs transition host, and the other is the FTP server. The ftp connection is successful in ipv4 address,but failed in ipv6 address. The failure is tcp6 checksum error in tcp_dnat_handler(tcp_dnat_handler-> tcp_csum_check->csum_ipv6_magic), I trace back where skb->csum is assigned and found skb->csum is assigned in nf_ip6_checksum in case CHECKSUM_NONE(ipv6_conntrack_in=> nf_conntrack_in => nf_conntrack_tcp_packet => nf_ip6_checksum). I don't know much about ipv6 checksums,why ipv6 nf_conntrack assign skb->csum but check error in ipvs tcp_dnat_handler? Best wishes! ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ftp ipvs connect failed in ipv6 2025-02-10 13:06 ftp ipvs connect failed in ipv6 mengkanglai @ 2025-02-11 13:55 ` Julian Anastasov 2025-02-15 11:09 ` m30030393 0 siblings, 1 reply; 4+ messages in thread From: Julian Anastasov @ 2025-02-11 13:55 UTC (permalink / raw) To: mengkanglai Cc: Pablo Neira Ayuso, Jozsef Kadlecsik, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Yanan (Euler), Fengtao (fengtao, Euler), gaoxingwang (A), lvs-devel Hello, On Mon, 10 Feb 2025, mengkanglai wrote: > Hello: > I found a problem with ftp ipvs. > I create 3 virtual machine in one host. One is the FTP client, the other is the ipvs transition host, and the other is the FTP server. > The ftp connection is successful in ipv4 address,but failed in ipv6 address. > The failure is tcp6 checksum error in tcp_dnat_handler(tcp_dnat_handler-> tcp_csum_check->csum_ipv6_magic), > I trace back where skb->csum is assigned and found skb->csum is assigned in nf_ip6_checksum in case CHECKSUM_NONE(ipv6_conntrack_in=> nf_conntrack_in => nf_conntrack_tcp_packet => nf_ip6_checksum). > I don't know much about ipv6 checksums,why ipv6 nf_conntrack assign skb->csum but check error in ipvs tcp_dnat_handler? Looks like the checksum validation does not use correct offset for the protocol header in the case with IPv6. Do you see extension headers before the final IPv6 header that points to TCP header? If that is the case, the following patch can help. If you prefer, you can apply just the TCP part for the FTP test. Let me know if this solves the problem, thanks! [PATCH] ipvs: provide correct ipv6 proto offset for csum checks Protocol checksum validation fails if there are multiple IPv6 headers before the protocol header. iph->len already contains its offset, so use it to fix the problem. Signed-off-by: Julian Anastasov <ja@ssi.bg> --- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 ++++++------------ net/netfilter/ipvs/ip_vs_proto_tcp.c | 19 ++++++------------- net/netfilter/ipvs/ip_vs_proto_udp.c | 18 ++++++------------ 3 files changed, 18 insertions(+), 37 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c index 83e452916403..63c78a1f3918 100644 --- a/net/netfilter/ipvs/ip_vs_proto_sctp.c +++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c @@ -10,7 +10,8 @@ #include <net/ip_vs.h> static int -sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); +sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int sctphoff); static int sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -108,7 +109,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!sctp_csum_check(cp->af, skb, pp)) + if (!sctp_csum_check(cp->af, skb, pp, sctphoff)) return 0; /* Call application helper if needed */ @@ -156,7 +157,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!sctp_csum_check(cp->af, skb, pp)) + if (!sctp_csum_check(cp->af, skb, pp, sctphoff)) return 0; /* Call application helper if needed */ @@ -185,19 +186,12 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, } static int -sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) +sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int sctphoff) { - unsigned int sctphoff; struct sctphdr *sh; __le32 cmp, val; -#ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) - sctphoff = sizeof(struct ipv6hdr); - else -#endif - sctphoff = ip_hdrlen(skb); - sh = (struct sctphdr *)(skb->data + sctphoff); cmp = sh->checksum; val = sctp_compute_cksum(skb, sctphoff); diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c index 7da51390cea6..dabdb9d3b479 100644 --- a/net/netfilter/ipvs/ip_vs_proto_tcp.c +++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c @@ -29,7 +29,8 @@ #include <net/ip_vs.h> static int -tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); +tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int tcphoff); static int tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -166,7 +167,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!tcp_csum_check(cp->af, skb, pp)) + if (!tcp_csum_check(cp->af, skb, pp, tcphoff)) return 0; /* Call application helper if needed */ @@ -244,7 +245,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!tcp_csum_check(cp->af, skb, pp)) + if (!tcp_csum_check(cp->af, skb, pp, tcphoff)) return 0; /* @@ -301,17 +302,9 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, static int -tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) +tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int tcphoff) { - unsigned int tcphoff; - -#ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) - tcphoff = sizeof(struct ipv6hdr); - else -#endif - tcphoff = ip_hdrlen(skb); - switch (skb->ip_summed) { case CHECKSUM_NONE: skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0); diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c index 68260d91c988..e99e7c5df869 100644 --- a/net/netfilter/ipvs/ip_vs_proto_udp.c +++ b/net/netfilter/ipvs/ip_vs_proto_udp.c @@ -25,7 +25,8 @@ #include <net/ip6_checksum.h> static int -udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); +udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int udphoff); static int udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -155,7 +156,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!udp_csum_check(cp->af, skb, pp)) + if (!udp_csum_check(cp->af, skb, pp, udphoff)) return 0; /* @@ -238,7 +239,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!udp_csum_check(cp->af, skb, pp)) + if (!udp_csum_check(cp->af, skb, pp, udphoff)) return 0; /* @@ -297,17 +298,10 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, static int -udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) +udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int udphoff) { struct udphdr _udph, *uh; - unsigned int udphoff; - -#ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) - udphoff = sizeof(struct ipv6hdr); - else -#endif - udphoff = ip_hdrlen(skb); uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph); if (uh == NULL) -- 2.48.1 Regards -- Julian Anastasov <ja@ssi.bg> ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: ftp ipvs connect failed in ipv6 2025-02-11 13:55 ` Julian Anastasov @ 2025-02-15 11:09 ` m30030393 2025-02-16 9:27 ` Julian Anastasov 0 siblings, 1 reply; 4+ messages in thread From: m30030393 @ 2025-02-15 11:09 UTC (permalink / raw) To: ja Cc: pablo, kadlec, davem, edumazet, kuba, pabeni, horms, netfilter-devel, coreteam, netdev, linux-kernel, yanan, fengtao40, gaoxingwang1, lvs-devel Tue, 11 Feb 2025, Julian Anastasov wrote: >> >> >> Hello, >> >>On Mon, 10 Feb 2025, mengkanglai wrote: >> >>> Hello: >>> I found a problem with ftp ipvs. >>> I create 3 virtual machine in one host. One is the FTP client, the other is the ipvs transition host, and the other is the FTP server. >>> The ftp connection is successful in ipv4 address,but failed in ipv6 address. >>> The failure is tcp6 checksum error in >>> tcp_dnat_handler(tcp_dnat_handler-> tcp_csum_check->csum_ipv6_magic), I trace back where skb->csum is assigned and found skb->csum is assigned in nf_ip6_checksum in case CHECKSUM_NONE(ipv6_conntrack_in=> nf_conntrack_in => nf_conntrack_tcp_packet => nf_ip6_checksum). >>> I don't know much about ipv6 checksums,why ipv6 nf_conntrack assign skb->csum but check error in ipvs tcp_dnat_handler? >> >> Looks like the checksum validation does not use correct offset for the protocol header in the case with IPv6. Do you see extension headers before the final IPv6 header that points to TCP header? If that is the case, the following patch can help. If you prefer, you can apply just the TCP part for the FTP test. Let me know if this solves the problem, thanks! Thanks for your help, but the following patch can't help. see extension headers before the IPv6 header, it’s just the common first SYN packet of the IPv6 three-way handshake but csum check failed in tcp_csum_check. I tried different offsets for the protocol header but doesn't work. >>[PATCH] ipvs: provide correct ipv6 proto offset for csum checks >> >>Protocol checksum validation fails if there are multiple IPv6 headers before the protocol header. iph->len already contains its offset, so use it to fix the problem. >> >>Signed-off-by: Julian Anastasov <ja@ssi.bg> >>--- >> net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 ++++++------------ net/netfilter/ipvs/ip_vs_proto_tcp.c | 19 ++++++------------- net/netfilter/ipvs/ip_vs_proto_udp.c | 18 ++++++------------ >> 3 files changed, 18 insertions(+), 37 deletions(-) >> >>diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c >>index 83e452916403..63c78a1f3918 100644 >>--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c >>+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c >>@@ -10,7 +10,8 @@ >> #include <net/ip_vs.h> >> >> static int >>-sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); >>+sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, >>+ unsigned int sctphoff); >> >> static int >> sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -108,7 +109,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> int ret; >> >> /* Some checks before mangling */ >>- if (!sctp_csum_check(cp->af, skb, pp)) >>+ if (!sctp_csum_check(cp->af, skb, pp, sctphoff)) >> return 0; >> >> /* Call application helper if needed */ @@ -156,7 +157,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> int ret; >> >> /* Some checks before mangling */ >>- if (!sctp_csum_check(cp->af, skb, pp)) >>+ if (!sctp_csum_check(cp->af, skb, pp, sctphoff)) >> return 0; >> >> /* Call application helper if needed */ @@ -185,19 +186,12 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, } >> >> static int >>-sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) >>+sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, >>+ unsigned int sctphoff) >> { >>- unsigned int sctphoff; >> struct sctphdr *sh; >> __le32 cmp, val; >> >>-#ifdef CONFIG_IP_VS_IPV6 >>- if (af == AF_INET6) >>- sctphoff = sizeof(struct ipv6hdr); >>- else >>-#endif >>- sctphoff = ip_hdrlen(skb); >>- >> sh = (struct sctphdr *)(skb->data + sctphoff); >> cmp = sh->checksum; >> val = sctp_compute_cksum(skb, sctphoff); diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c >>index 7da51390cea6..dabdb9d3b479 100644 >>--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c >>+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c >>@@ -29,7 +29,8 @@ >> #include <net/ip_vs.h> >> >> static int >>-tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); >>+tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, >>+ unsigned int tcphoff); >> >> static int >> tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -166,7 +167,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> int ret; >> >> /* Some checks before mangling */ >>- if (!tcp_csum_check(cp->af, skb, pp)) >>+ if (!tcp_csum_check(cp->af, skb, pp, tcphoff)) >> return 0; >> >> /* Call application helper if needed */ @@ -244,7 +245,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> int ret; >> >> /* Some checks before mangling */ >>- if (!tcp_csum_check(cp->af, skb, pp)) >>+ if (!tcp_csum_check(cp->af, skb, pp, tcphoff)) >> return 0; >> >> /* >>@@ -301,17 +302,9 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> >> >> static int >>-tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) >>+tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, >>+ unsigned int tcphoff) >> { >>- unsigned int tcphoff; >>- >>-#ifdef CONFIG_IP_VS_IPV6 >>- if (af == AF_INET6) >>- tcphoff = sizeof(struct ipv6hdr); >>- else >>-#endif >>- tcphoff = ip_hdrlen(skb); >>- >> switch (skb->ip_summed) { >> case CHECKSUM_NONE: >> skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0); diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c >>index 68260d91c988..e99e7c5df869 100644 >>--- a/net/netfilter/ipvs/ip_vs_proto_udp.c >>+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c >>@@ -25,7 +25,8 @@ >> #include <net/ip6_checksum.h> >> >> static int >>-udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); >>+udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, >>+ unsigned int udphoff); >> >> static int >> udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -155,7 +156,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> int ret; >> >> /* Some checks before mangling */ >>- if (!udp_csum_check(cp->af, skb, pp)) >>+ if (!udp_csum_check(cp->af, skb, pp, udphoff)) >> return 0; >> >> /* >>@@ -238,7 +239,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> int ret; >> >> /* Some checks before mangling */ >>- if (!udp_csum_check(cp->af, skb, pp)) >>+ if (!udp_csum_check(cp->af, skb, pp, udphoff)) >> return 0; >> >> /* >>@@ -297,17 +298,10 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, >> >> >> static int >>-udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) >>+udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, >>+ unsigned int udphoff) >> { >> struct udphdr _udph, *uh; >>- unsigned int udphoff; >>- >>-#ifdef CONFIG_IP_VS_IPV6 >>- if (af == AF_INET6) >>- udphoff = sizeof(struct ipv6hdr); >>- else >>-#endif >>- udphoff = ip_hdrlen(skb); >> >> uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph); >> if (uh == NULL) >>-- >>2.48.1 >> >> >>Regards >> >>-- >>Julian Anastasov <ja@ssi.bg> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ftp ipvs connect failed in ipv6 2025-02-15 11:09 ` m30030393 @ 2025-02-16 9:27 ` Julian Anastasov 0 siblings, 0 replies; 4+ messages in thread From: Julian Anastasov @ 2025-02-16 9:27 UTC (permalink / raw) To: m30030393 Cc: pablo, kadlec, davem, edumazet, kuba, pabeni, horms, netfilter-devel, coreteam, netdev, linux-kernel, yanan, fengtao40, gaoxingwang1, lvs-devel [-- Attachment #1: Type: text/plain, Size: 8113 bytes --] Hello, On Sat, 15 Feb 2025, m30030393 wrote: > Tue, 11 Feb 2025, Julian Anastasov wrote: > >> > >>On Mon, 10 Feb 2025, mengkanglai wrote: > >> > >>> Hello: > >>> I found a problem with ftp ipvs. > >>> I create 3 virtual machine in one host. One is the FTP client, the other is the ipvs transition host, and the other is the FTP server. > >>> The ftp connection is successful in ipv4 address,but failed in ipv6 address. > >>> The failure is tcp6 checksum error in > >>> tcp_dnat_handler(tcp_dnat_handler-> tcp_csum_check->csum_ipv6_magic), I trace back where skb->csum is assigned and found skb->csum is assigned in nf_ip6_checksum in case CHECKSUM_NONE(ipv6_conntrack_in=> nf_conntrack_in => nf_conntrack_tcp_packet => nf_ip6_checksum). > >>> I don't know much about ipv6 checksums,why ipv6 nf_conntrack assign skb->csum but check error in ipvs tcp_dnat_handler? > >> > >> Looks like the checksum validation does not use correct offset for the protocol header in the case with IPv6. Do you see extension headers before the final IPv6 header that points to TCP header? If that is the case, the following patch can help. If you prefer, you can apply just the TCP part for the FTP test. Let me know if this solves the problem, thanks! > > Thanks for your help, but the following patch can't help. see extension headers before the IPv6 header, it’s just the common first SYN packet of the IPv6 three-way handshake but csum check failed in tcp_csum_check. > I tried different offsets for the protocol header but doesn't work. The previous patch needs more changes, see below v2 where we also provide correct protocol value. If this patch does not help, send me more info, if you prefer privately: - packet capture file containing such packet - does it happen for other service (port), eg. 80/443 or just on 21 - the skb->ip_summed, tcphoff and skb->csum values in tcp_csum_check [PATCHv2] ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph->len already contains its offset, so use it to fix the problem. Signed-off-by: Julian Anastasov <ja@ssi.bg> --- net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 ++++++------------ net/netfilter/ipvs/ip_vs_proto_tcp.c | 21 +++++++-------------- net/netfilter/ipvs/ip_vs_proto_udp.c | 20 +++++++------------- 3 files changed, 20 insertions(+), 39 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c index 83e452916403..63c78a1f3918 100644 --- a/net/netfilter/ipvs/ip_vs_proto_sctp.c +++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c @@ -10,7 +10,8 @@ #include <net/ip_vs.h> static int -sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); +sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int sctphoff); static int sctp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -108,7 +109,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!sctp_csum_check(cp->af, skb, pp)) + if (!sctp_csum_check(cp->af, skb, pp, sctphoff)) return 0; /* Call application helper if needed */ @@ -156,7 +157,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!sctp_csum_check(cp->af, skb, pp)) + if (!sctp_csum_check(cp->af, skb, pp, sctphoff)) return 0; /* Call application helper if needed */ @@ -185,19 +186,12 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, } static int -sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) +sctp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int sctphoff) { - unsigned int sctphoff; struct sctphdr *sh; __le32 cmp, val; -#ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) - sctphoff = sizeof(struct ipv6hdr); - else -#endif - sctphoff = ip_hdrlen(skb); - sh = (struct sctphdr *)(skb->data + sctphoff); cmp = sh->checksum; val = sctp_compute_cksum(skb, sctphoff); diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c index 7da51390cea6..ede4fa3b63f5 100644 --- a/net/netfilter/ipvs/ip_vs_proto_tcp.c +++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c @@ -29,7 +29,8 @@ #include <net/ip_vs.h> static int -tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); +tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int tcphoff); static int tcp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -166,7 +167,7 @@ tcp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!tcp_csum_check(cp->af, skb, pp)) + if (!tcp_csum_check(cp->af, skb, pp, tcphoff)) return 0; /* Call application helper if needed */ @@ -244,7 +245,7 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!tcp_csum_check(cp->af, skb, pp)) + if (!tcp_csum_check(cp->af, skb, pp, tcphoff)) return 0; /* @@ -301,17 +302,9 @@ tcp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, static int -tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) +tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int tcphoff) { - unsigned int tcphoff; - -#ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) - tcphoff = sizeof(struct ipv6hdr); - else -#endif - tcphoff = ip_hdrlen(skb); - switch (skb->ip_summed) { case CHECKSUM_NONE: skb->csum = skb_checksum(skb, tcphoff, skb->len - tcphoff, 0); @@ -322,7 +315,7 @@ tcp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->len - tcphoff, - ipv6_hdr(skb)->nexthdr, + IPPROTO_TCP, skb->csum)) { IP_VS_DBG_RL_PKT(0, af, pp, skb, 0, "Failed checksum for"); diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c index 68260d91c988..ffbebda547fc 100644 --- a/net/netfilter/ipvs/ip_vs_proto_udp.c +++ b/net/netfilter/ipvs/ip_vs_proto_udp.c @@ -25,7 +25,8 @@ #include <net/ip6_checksum.h> static int -udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp); +udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int udphoff); static int udp_conn_schedule(struct netns_ipvs *ipvs, int af, struct sk_buff *skb, @@ -155,7 +156,7 @@ udp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!udp_csum_check(cp->af, skb, pp)) + if (!udp_csum_check(cp->af, skb, pp, udphoff)) return 0; /* @@ -238,7 +239,7 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, int ret; /* Some checks before mangling */ - if (!udp_csum_check(cp->af, skb, pp)) + if (!udp_csum_check(cp->af, skb, pp, udphoff)) return 0; /* @@ -297,17 +298,10 @@ udp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, static int -udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) +udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp, + unsigned int udphoff) { struct udphdr _udph, *uh; - unsigned int udphoff; - -#ifdef CONFIG_IP_VS_IPV6 - if (af == AF_INET6) - udphoff = sizeof(struct ipv6hdr); - else -#endif - udphoff = ip_hdrlen(skb); uh = skb_header_pointer(skb, udphoff, sizeof(_udph), &_udph); if (uh == NULL) @@ -325,7 +319,7 @@ udp_csum_check(int af, struct sk_buff *skb, struct ip_vs_protocol *pp) if (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->len - udphoff, - ipv6_hdr(skb)->nexthdr, + IPPROTO_UDP, skb->csum)) { IP_VS_DBG_RL_PKT(0, af, pp, skb, 0, "Failed checksum for"); -- 2.48.1 Regards -- Julian Anastasov <ja@ssi.bg> ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-02-16 9:27 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-02-10 13:06 ftp ipvs connect failed in ipv6 mengkanglai 2025-02-11 13:55 ` Julian Anastasov 2025-02-15 11:09 ` m30030393 2025-02-16 9:27 ` Julian Anastasov
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.