From: David Miller <davem@davemloft.net>
To: aatteka@ovn.org
Cc: netdev@vger.kernel.org
Subject: Re: [PATCH net] udp: disable inner UDP checksum offloads in IPsec case
Date: Mon, 24 Apr 2017 13:49:13 -0400 (EDT) [thread overview]
Message-ID: <20170424.134913.859328581317183203.davem@davemloft.net> (raw)
In-Reply-To: <1492813385-31736-1-git-send-email-aatteka@ovn.org>
From: Ansis Atteka <aatteka@ovn.org>
Date: Fri, 21 Apr 2017 15:23:05 -0700
> Otherwise, UDP checksum offloads could corrupt ESP packets by attempting
> to calculate UDP checksum when this inner UDP packet is already protected
> by IPsec.
>
> One way to reproduce this bug is to have a VM with virtio_net driver (UFO
> set to ON in the guest VM); and then encapsulate all guest's Ethernet
> frames in Geneve; and then further encrypt Geneve with IPsec. In this
> case following symptoms are observed:
> 1. If using ixgbe NIC, then it will complain with following error message:
> ixgbe 0000:01:00.1: partial checksum but l4 proto=32!
> 2. Receiving IPsec stack will drop all the corrupted ESP packets and
> increase XfrmInStateProtoError counter in /proc/net/xfrm_stat.
> 3. iperf UDP test from the VM with packet sizes above MTU will not work at
> all.
> 4. iperf TCP test from the VM will get ridiculously low performance because.
>
> Signed-off-by: Ansis Atteka <aatteka@ovn.org>
> Co-authored-by: Steffen Klassert <steffen.klassert@secunet.com>
Applied, thanks.
prev parent reply other threads:[~2017-04-24 17:49 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-21 22:23 [PATCH net] udp: disable inner UDP checksum offloads in IPsec case Ansis Atteka
2017-04-24 17:49 ` David Miller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170424.134913.859328581317183203.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=aatteka@ovn.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).