linux-kernel - Re: [PATCH v3] [net]: Fix skb->csum update in inet_proto_csum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Jan 2020 11:17:02 +0100
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Praveen Chaudhary <praveen5582@...il.com>, fw@...len.de,
        pablo@...filter.org, davem@...emloft.net, kadlec@...filter.org,
        netfilter-devel@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     Zhenggen Xu <zxu@...kedin.com>,
        Andy Stracner <astracner@...kedin.com>
Subject: Re: [PATCH v3] [net]: Fix skb->csum update in
 inet_proto_csum_replace16().

On 11/6/19 11:52 PM, Praveen Chaudhary wrote:
> skb->csum is updated incorrectly, when manipulation for NF_NAT_MANIP_SRC\DST
> is done on IPV6 packet.
> 
> Fix:
> No need to update skb->csum in function inet_proto_csum_replace16(), even if
> skb->ip_summed == CHECKSUM_COMPLETE, because change in L4 header checksum field
> and change in IPV6 header cancels each other for skb->csum calculation.
> 
> Signed-off-by: Praveen Chaudhary <pchaudhary@...kedin.com>
> Signed-off-by: Zhenggen Xu <zxu@...kedin.com>
> Signed-off-by: Andy Stracner <astracner@...kedin.com>
> 
> Reviewed-by: Florian Westphal <fw@...len.de>
> ---
> Changes in V2.
> 1.) Updating diff as per email discussion with Florian Westphal.
>      Since inet_proto_csum_replace16() does incorrect calculation
>      for skb->csum in all cases.
> 2.) Change in Commmit logs.
> ---
> 
> ---
> Changes in V3.
> Addressing Pablo`s Suggesion.
> 1.) Updated Subject and description
> 2.) Added full documentation of function.
> ---
> ---
>   net/core/utils.c | 18 +++++++++++++++---
>   1 file changed, 15 insertions(+), 3 deletions(-)
> 
> diff --git a/net/core/utils.c b/net/core/utils.c
> index 6b6e51d..af3b5cb 100644
> --- a/net/core/utils.c
> +++ b/net/core/utils.c
> @@ -438,6 +438,21 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
>   }
>   EXPORT_SYMBOL(inet_proto_csum_replace4);
>   
> +/**
> + * inet_proto_csum_replace16 - update L4 header checksum field as per the
> + * update in IPv6 Header. Note, there is no need to update skb->csum in this
> + * function, even if skb->ip_summed == CHECKSUM_COMPLETE, because change in L4
> + * header checksum field and change in IPV6 header cancels each other for
> + * skb->csum calculation.
> + *
> + * @sum: L4 header checksum field
> + * @skb: sk_buff for the packet
> + * @from: old IPv6 address
> + * @to: new IPv6 address
> + * @pseudohdr: True if L4 header checksum includes pseudoheader
> + *
> + * Return void
> + */
>   void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
>   			       const __be32 *from, const __be32 *to,
>   			       bool pseudohdr)
> @@ -449,9 +464,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
>   	if (skb->ip_summed != CHECKSUM_PARTIAL) {
>   		*sum = csum_fold(csum_partial(diff, sizeof(diff),
>   				 ~csum_unfold(*sum)));
> -		if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
> -			skb->csum = ~csum_partial(diff, sizeof(diff),
> -						  ~skb->csum);

What is the technical rationale in removing this here but not in any of the
other inet_proto_csum_replace*() functions? You changelog has zero analysis
on why here but not elsewhere this change would be needed?

>   	} else if (pseudohdr)
>   		*sum = ~csum_fold(csum_partial(diff, sizeof(diff),
>   				  csum_unfold(*sum)));
>