[PATCH v2] openvswitch: Fix L4 checksum handling when dealing with IP fragments

[PATCH v2] openvswitch: Fix L4 checksum handling when dealing with IP fragments

[Glenn Griffin]

openvswitch modifies the L4 checksum of a packet when modifying
the ip address. When an IP packet is fragmented only the first
fragment contains an L4 header and checksum. Prior to this change
openvswitch would modify all fragments, modifying application data
in non-first fragments, causing checksum failures in the
reassembled packet.

Signed-off-by: Glenn Griffin <ggriffin.kernel@gmail.com>
---
Changes in v2:
  - Compare frag_off in network byte order rather than host byte order

 net/openvswitch/actions.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 8a8c0b8..ee34f47 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -273,28 +273,36 @@ static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
 	return 0;
 }
 
-static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
-			__be32 *addr, __be32 new_addr)
+static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
+				  __be32 addr, __be32 new_addr)
 {
 	int transport_len = skb->len - skb_transport_offset(skb);
 
+	if (nh->frag_off & htons(IP_OFFSET))
+		return;
+
 	if (nh->protocol == IPPROTO_TCP) {
 		if (likely(transport_len >= sizeof(struct tcphdr)))
 			inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
-						 *addr, new_addr, 1);
+						 addr, new_addr, 1);
 	} else if (nh->protocol == IPPROTO_UDP) {
 		if (likely(transport_len >= sizeof(struct udphdr))) {
 			struct udphdr *uh = udp_hdr(skb);
 
 			if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
 				inet_proto_csum_replace4(&uh->check, skb,
-							 *addr, new_addr, 1);
+							 addr, new_addr, 1);
 				if (!uh->check)
 					uh->check = CSUM_MANGLED_0;
 			}
 		}
 	}
+}
 
+static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
+			__be32 *addr, __be32 new_addr)
+{
+	update_ip_l4_checksum(skb, nh, *addr, new_addr);
 	csum_replace4(&nh->check, *addr, new_addr);
 	skb_clear_hash(skb);
 	*addr = new_addr;
-- 
2.1.4

_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev

Re: [PATCH v2] openvswitch: Fix L4 checksum handling when dealing with IP fragments

[Pravin Shelar]

On Mon, Aug 3, 2015 at 9:56 AM, Glenn Griffin <ggriffin.kernel@gmail.com> wrote:
> openvswitch modifies the L4 checksum of a packet when modifying
> the ip address. When an IP packet is fragmented only the first
> fragment contains an L4 header and checksum. Prior to this change
> openvswitch would modify all fragments, modifying application data
> in non-first fragments, causing checksum failures in the
> reassembled packet.
>
> Signed-off-by: Glenn Griffin <ggriffin.kernel@gmail.com>

Looks good.
Acked-by: Pravin B Shelar <pshelar@nicira.com>

This patch needs to be backported to stable branches.

Thanks.
_______________________________________________
dev mailing list
dev@openvswitch.org
http://openvswitch.org/mailman/listinfo/dev

Re: [PATCH v2] openvswitch: Fix L4 checksum handling when dealing with IP fragments

[David Miller]

From: Glenn Griffin <ggriffin.kernel@gmail.com>
Date: Mon, 3 Aug 2015 09:56:54 -0700

> openvswitch modifies the L4 checksum of a packet when modifying
> the ip address. When an IP packet is fragmented only the first
> fragment contains an L4 header and checksum. Prior to this change
> openvswitch would modify all fragments, modifying application data
> in non-first fragments, causing checksum failures in the
> reassembled packet.
> 
> Signed-off-by: Glenn Griffin <ggriffin.kernel@gmail.com>
> ---
> Changes in v2:
>   - Compare frag_off in network byte order rather than host byte order

Applied and queued up for -stable.

Re: [PATCH v2] openvswitch: Fix L4 checksum handling when dealing with IP fragments

[Glenn Griffin]

On Mon, Aug 03, 2015 at 02:03:28PM -0700, David Miller wrote:
> From: Glenn Griffin <ggriffin.kernel@gmail.com>
> Date: Mon, 3 Aug 2015 09:56:54 -0700
> 
> > openvswitch modifies the L4 checksum of a packet when modifying
> > the ip address. When an IP packet is fragmented only the first
> > fragment contains an L4 header and checksum. Prior to this change
> > openvswitch would modify all fragments, modifying application data
> > in non-first fragments, causing checksum failures in the
> > reassembled packet.
> > 
> > Signed-off-by: Glenn Griffin <ggriffin.kernel@gmail.com>
> > ---
> > Changes in v2:
> >   - Compare frag_off in network byte order rather than host byte order
> 
> Applied and queued up for -stable.

I noticed this change didn't seem to make it into 4.2-rc6. I'm not too
familiar with the release schedule so wasn't sure if that was expected
or an oversight. Will this remain queued up until the 4.3 merge window
opens?

Re: [PATCH v2] openvswitch: Fix L4 checksum handling when dealing with IP fragments

[David Miller]

From: Glenn Griffin <ggriffin.kernel@gmail.com>
Date: Mon, 10 Aug 2015 10:43:16 -0700

> On Mon, Aug 03, 2015 at 02:03:28PM -0700, David Miller wrote:
>> From: Glenn Griffin <ggriffin.kernel@gmail.com>
>> Date: Mon, 3 Aug 2015 09:56:54 -0700
>> 
>> > openvswitch modifies the L4 checksum of a packet when modifying
>> > the ip address. When an IP packet is fragmented only the first
>> > fragment contains an L4 header and checksum. Prior to this change
>> > openvswitch would modify all fragments, modifying application data
>> > in non-first fragments, causing checksum failures in the
>> > reassembled packet.
>> > 
>> > Signed-off-by: Glenn Griffin <ggriffin.kernel@gmail.com>
>> > ---
>> > Changes in v2:
>> >   - Compare frag_off in network byte order rather than host byte order
>> 
>> Applied and queued up for -stable.
> 
> I noticed this change didn't seem to make it into 4.2-rc6. I'm not too
> familiar with the release schedule so wasn't sure if that was expected
> or an oversight. Will this remain queued up until the 4.3 merge window
> opens?

It's in my 'net' tree and will be pushed to Linus's tree at a time that I
deem appropriate.  Usually I try to push to Linus one every week or so,
in order for changes to soak and get tested in my tree before they get
pushed to his.