lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240425162842.23900-1-iluceno@suse.de>
Date: Thu, 25 Apr 2024 18:28:40 +0200
From: Ismael Luceno <iluceno@...e.de>
To: linux-kernel@...r.kernel.org
Cc: Ismael Luceno <iluceno@...e.de>,
	Firo Yang <firo.yang@...e.com>,
	Andreas Taschner <andreas.taschner@...e.com>,
	Michal Kubeček <mkubecek@...e.com>,
	Simon Horman <horms@...ge.net.au>,
	Julian Anastasov <ja@....bg>,
	lvs-devel@...r.kernel.org,
	netfilter-devel@...r.kernel.org,
	netdev@...r.kernel.org,
	coreteam@...filter.org
Subject: [PATCH v3] ipvs: Fix checksumming on GSO of SCTP packets

It was observed in the wild that pairs of consecutive packets would leave
the IPVS with the same wrong checksum, and the issue only went away when
disabling GSO.

IPVS needs to avoid computing the SCTP checksum when using GSO.

Fixes: 90017accff61 ("sctp: Add GSO support", 2016-06-02)
Co-developed-by: Firo Yang <firo.yang@...e.com>
Signed-off-by: Ismael Luceno <iluceno@...e.de>
Tested-by: Andreas Taschner <andreas.taschner@...e.com>
CC: Michal Kubeček <mkubecek@...e.com>
CC: Simon Horman <horms@...ge.net.au>
CC: Julian Anastasov <ja@....bg>
CC: lvs-devel@...r.kernel.org
CC: netfilter-devel@...r.kernel.org
CC: netdev@...r.kernel.org
CC: coreteam@...filter.org
---

Notes:
    Changes since v2:
    * Use only skb_is_gso, no need to check for GSO type
    
    Changes since v1:
    * Added skb_is_gso before skb_is_gso_sctp.
    * Added "Fixes" tag.

 net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index a0921adc31a9..83e452916403 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 	if (sctph->source != cp->vport || payload_csum ||
 	    skb->ip_summed == CHECKSUM_PARTIAL) {
 		sctph->source = cp->vport;
-		sctp_nat_csum(skb, sctph, sctphoff);
+		if (!skb_is_gso(skb))
+			sctp_nat_csum(skb, sctph, sctphoff);
 	} else {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
@@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 	    (skb->ip_summed == CHECKSUM_PARTIAL &&
 	     !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) {
 		sctph->dest = cp->dport;
-		sctp_nat_csum(skb, sctph, sctphoff);
+		if (!skb_is_gso(skb))
+			sctp_nat_csum(skb, sctph, sctphoff);
 	} else if (skb->ip_summed != CHECKSUM_PARTIAL) {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
-- 
2.43.0


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ