lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 15 Nov 2013 12:20:58 +0800
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Alexander Duyck <alexander.h.duyck@...el.com>
Cc:	davem@...emloft.net, netdev@...r.kernel.org, edumazet@...gle.com,
	herbert@...dor.apana.org
Subject: Re: [PATCH] net: Do not include padding in TCP GRO checksum

On Thu, Nov 14, 2013 at 05:18:18PM -0800, Alexander Duyck wrote:
> In some recent tests where I was generating invalid frames I found that
> the checksum was being treated as valid for certain frames that computed
> the checksum with padding included.  On closer inspection I found the
> issue was that GRO was using the skb->len instead of the length recorded in
> the IP/IPv6 header to determine the number of bytes to checksum.  As such
> padded frames that actually had invalid checksums generated by adding the
> padding to the checksum were being incorrectly tagged as valid.
> 
> This change corrects that by using the tot_len from IPv4 headers and the
> payload_len from IPv6 headers to compute the total number of bytes to be
> included in the checksum.
> 
> Signed-off-by: Alexander Duyck <alexander.h.duyck@...el.com>

Good catch.

> +	/* adjust for any offsets */
> +	length += skb_network_offset(skb) - skb_gro_offset(skb);

Since skb->csum includes your padding, you'll need to adjust that
as well.  Also this is not the only place where we use skb_gro_len
to measure the packet length.  So rather than changing each one
of them, I think we could just do a pskb_trim_rcsum at the point
where we obtain the network packet length, i.e., in ipv4/ipv6.

We should then fix pskb_trim_rcsum to adjust CHECKSUM_COMPLETE
checksums as otherwise your NIC's RX checksum offload feature
will be useless.

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists