netdev - Re: [PATCH net] xfrm: calculate L4 checksums also for GSO case before encrypting packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Apr 2017 11:47:43 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Ansis Atteka <ansisatteka@...il.com>
CC:     Ansis Atteka <aatteka@....org>, <netdev@...r.kernel.org>
Subject: Re: [PATCH net] xfrm: calculate L4 checksums also for GSO case
 before encrypting packets

On Tue, Apr 18, 2017 at 07:10:03PM -0700, Ansis Atteka wrote:
> 
> However, after taking pointers from your patch I came up with this one
> that may solve this problem once and for all (note, that I was seeing
> this bug only with ixgbe NIC that supports tx csum offloads). I hope
> it does not break any other IPsec tests that you have.
> 
> diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
> index b2be1d9..7812501 100644
> --- a/net/ipv4/udp_offload.c
> +++ b/net/ipv4/udp_offload.c
> @@ -29,6 +29,7 @@ static struct sk_buff
> *__skb_udp_tunnel_segment(struct sk_buff *skb,
>         u16 mac_len = skb->mac_len;
>         int udp_offset, outer_hlen;
>         __wsum partial;
> +       bool need_ipsec;
> 
>         if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
>                 goto out;
> @@ -62,8 +63,10 @@ static struct sk_buff
> *__skb_udp_tunnel_segment(struct sk_buff *skb,
> 
>         ufo = !!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP);
> 
> +       need_ipsec = skb_dst(skb) && dst_xfrm(skb_dst(skb));
>         /* Try to offload checksum if possible */
>         offload_csum = !!(need_csum &&
> +                         !need_ipsec &&
>                           (skb->dev->features &
>                            (is_ipv6 ? (NETIF_F_HW_CSUM | NETIF_F_IPV6_CSUM) :
>                                       (NETIF_F_HW_CSUM | NETIF_F_IP_CSUM))));

This looks good, but we should fix udp4_ufo_fragment() too.

Thanks!