netdev - RE: [RFC PATCH] lro: ip fragment checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 24 Nov 2008 13:04:33 -0800
From:	"Brandeburg, Jesse" <jesse.brandeburg@...el.com>
To:	Ben Hutchings <bhutchings@...arflare.com>,
	Jan-Bernd Themann <ossthema@...ibm.com>
CC:	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"tklein@...ibm.com" <tklein@...ibm.com>,
	Christoph Raisch <raisch@...ibm.com>,
	"jb.billaud@...il.com" <jb.billaud@...il.com>,
	"hering2@...ibm.com" <hering2@...ibm.com>
Subject: RE: [RFC PATCH] lro: ip fragment checking

Ben Hutchings wrote:
> On Mon, 2008-11-24 at 16:56 +0100, Jan-Bernd Themann wrote:
>> Currently there is no checking in the LRO receive path whether
>> TCP packets are ip fragmented. We should not consider
>> those packets for aggregation.
>> I'm not sure if this checking is actually required. Does anyone
>> know if it is possible to get fragmented TCP packets without
>> the tcp stack changing the MSS size?
>> This patch introduces explicit checking. Any objections?
> 
> LRO depends on the hardware performing TCP checksum offload, and the
> TCP checksum cannot be verified for IP fragments in isolation.  So I
> think drivers should not be passing fragments into inet_lro or should
> reject them in its get_frag_header() or get_skb_header() method. 
> Certainly sfc doesn't pass fragments into inet_lro because they have
> not been checksummed.

The fragments, definitely will not have checksums offloaded, but
what about the first packet in the chain?  I haven't verified in
ixgbe or igb whether or not it could try and aggregate a packet
with MF set if it was the first fragment in a series of IP fragments.--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html