[PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

[PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

[Keir Fraser]

[-- Attachment #1: Type: text/plain, Size: 750 bytes --]

The TCP/UDP connection-tracking code in netfilter validates the
checksum of incoming packets, to prevent nastier errors further down
the road. This check is unnecessary if the skb is marked as
CHECKSUM_UNNECESSARY. 

This patch will improve performance for networkinterfaces that perform
CHECKSUM_UNNECESSARY-style checksum offload (that's most modern
ones). More importantly (for me :-)) is that this makes netfilter play
nicely with checksum avoidance in the Xen virtual machine
monitor. Inter-domain traffic has no checksum calculated, so
validation checks will fail even though the packet data is good.
Of course, this avoidance relies on the network stack respecting
CHECKSUM_UNNECESSARY.

Signed-off-by: Keir Fraser <Keir.Fraser@xl.cam.ac.uk>


[-- Attachment #2: Checksum patch --]
[-- Type: text/plain, Size: 1351 bytes --]

diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c	2005-05-27 11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c	2005-05-27 11:48:07 +01:00
@@ -803,6 +803,7 @@
 	 */
 	/* FIXME: Source route IP option packets --RR */
 	if (hooknum == NF_IP_PRE_ROUTING
+	    && skb->ip_summed != CHECKSUM_UNNECESSARY
 	    && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
 			         skb->ip_summed == CHECKSUM_HW ? skb->csum
 			      	 : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c	2005-05-27 11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c	2005-05-27 11:48:07 +01:00
@@ -120,6 +120,7 @@
 	 * and moreover root might send raw packets.
 	 * FIXME: Source route IP option packets --RR */
 	if (hooknum == NF_IP_PRE_ROUTING
+	    && skb->ip_summed != CHECKSUM_UNNECESSARY
 	    && csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
 			         skb->ip_summed == CHECKSUM_HW ? skb->csum
 			      	 : skb_checksum(skb, iph->ihl*4, udplen, 0))) {

Re: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

[Phil Oester]

On Fri, May 27, 2005 at 12:03:08PM +0100, Keir Fraser wrote:
> The TCP/UDP connection-tracking code in netfilter validates the
> checksum of incoming packets, to prevent nastier errors further down
> the road. This check is unnecessary if the skb is marked as
> CHECKSUM_UNNECESSARY. 

It seems at least part of this has already been merged in 2.6.12-rc

http://www.kernel.org/git/gitweb.cgi?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;h=721ddbf522b422d554479a7ab15c0955798f16ee;hp=2b87c1974be605d5bdb1ee769188d7e03fb2ddc8;hb=31da185d8162ae0f30a13ed945f1f4d28d158133;f=net/ipv4/netfilter/ip_conntrack_proto_tcp.c

Phil

Re: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

[Keir Fraser]

On 27 May 2005, at 12:20, Phil Oester wrote:

> On Fri, May 27, 2005 at 12:03:08PM +0100, Keir Fraser wrote:
>> The TCP/UDP connection-tracking code in netfilter validates the
>> checksum of incoming packets, to prevent nastier errors further down
>> the road. This check is unnecessary if the skb is marked as
>> CHECKSUM_UNNECESSARY.
>
> It seems at least part of this has already been merged in 2.6.12-rc

It would be great if the UDP code also would observe 
CHECKSUM_UNNECESSARY. I'll wait for 2.6.12 to appear and then submit a 
new patch if UDP has been missed.

  Thanks,
  Keir

Re: [netfilter-core] Re: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

[Patrick McHardy]

Keir Fraser wrote:
> On 27 May 2005, at 12:20, Phil Oester wrote:
>> On Fri, May 27, 2005 at 12:03:08PM +0100, Keir Fraser wrote:
>>
>>> The TCP/UDP connection-tracking code in netfilter validates the
>>> checksum of incoming packets, to prevent nastier errors further down
>>> the road. This check is unnecessary if the skb is marked as
>>> CHECKSUM_UNNECESSARY.
>>
>> It seems at least part of this has already been merged in 2.6.12-rc
> 
> It would be great if the UDP code also would observe
> CHECKSUM_UNNECESSARY. I'll wait for 2.6.12 to appear and then submit a
> new patch if UDP has been missed.

TCP was changed to fix a regression with loopback packets. I've added
the UDP part of your patch to my 2.6.13 tree.

Regards
Patrick