netdev - Re: [PATCH] netfilter: fix bad checksum on IPv6 when NAT is performed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 6 Oct 2015 16:28:44 +0200
From:	Pablo Neira Ayuso <pablo@...filter.org>
To:	Maxime Bizon <mbizon@...ebox.fr>
Cc:	netdev <netdev@...r.kernel.org>, davem <davem@...emloft.net>,
	kaber <kaber@...sh.net>
Subject: Re: [PATCH] netfilter: fix bad checksum on IPv6 when NAT is performed

On Tue, Oct 06, 2015 at 04:10:52PM +0200, Maxime Bizon wrote:
> 
> With this setup:
> 
> * non IPv6 checksumming capable network hardware
> * GRO off
> * IPv6 SNAT
> 
> I get this when I receive an UDPv6 reply: "<unknown>: hw csum failure"
> 
> Call trace:
> 
> * nf_ip6_checksum() calls __skb_checksum_complete()
> * nf_nat_ipv6_csum_update() & nf_nat_ipv6_manip_pkt()
> * __udp6_lib_rcv() => udp6_csum_init()
> * __skb_checksum_validate_complete() "fastpath" fails because
>   skb->csum is incorrect.
> * udpv6_recvmsg() => skb_copy_and_csum_datagram_msg()
> 
> The last call computes a valid checksum despite CHECKSUM_COMPLETE and
> triggers the warning.
> 
> When we perform NAT on IPv4, we also update the IPv4 checksum, so
> there is no side effect on skb->csum (since the csum over a valid IPv4
> header area is zero).
> 
> But IPv6 doesn't have such header checksum, so when performing NAT we need to
> update skb->csum.

Please, resubmit and Cc netfilter-devel@...r.kernel.org.

Thanks.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html