netdev - Re: [EXT] Re: Ping frame drop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 21 Jun 2021 16:41:28 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Arijit De <arijitde@...vell.com>
Cc:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [EXT] Re: Ping frame drop

Please don't top post.

On Sat, 19 Jun 2021 15:14:35 +0000 Arijit De wrote:
> In my network card HW it can verify the received frame's checksum of
> IPv4 header, but it can't verify the checksum of ICMP header. 

Linux does not offload IPv4 header checksums.

> So for
> ICMP kind of received frames driver sets the checksum state to
> CHECKSUM_PARTIAL in skb->ip_summed. Which is as per the linux kernel
> documentation also. 

What documentation are you reading? Setting ip_summed to PARTIAL on
receive is only valid for software/virtual devices, never real HW.

> Now before the commit
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8f9a69a92fc63917c9bd921b28e3b2912980becf
> this use case was working. But now after introducing this logic for
> CHECKSUM_PARTIAL case, my received ICMP ping frames are getting
> dropped in the linux kernel pskb_trim_rcsum_slow(). I do understand
> that to bypass this scenario I can use CHECKSUM_NONE, but in that
> case HW's capability where checksum is already verified for the IPv4
> header will be unutilized. 
> 
> So please do share if any documentation update has happened for the
> CHECKSUM_PARTIAL scenario or please do let me know what need to be
> updated in the skb for the receive frame in this scenario where only
> Networking layer (i.e. IPv4 in this case) checksum is verified but
> the ICMP(ping) header checksum is not verified  ?