From: Daniel Borkmann <daniel@iogearbox.net>
To: Florian Westphal <fw@strlen.de>
Cc: Praveen Chaudhary <praveen5582@gmail.com>,
pablo@netfilter.org, davem@davemloft.net, kadlec@netfilter.org,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, Zhenggen Xu <zxu@linkedin.com>,
Andy Stracner <astracner@linkedin.com>
Subject: Re: [PATCH v3] [net]: Fix skb->csum update in inet_proto_csum_replace16().
Date: Thu, 23 Jan 2020 15:20:39 +0100 [thread overview]
Message-ID: <1c1fc75d-e69c-f2f6-78ce-de9dc8aa89ca@iogearbox.net> (raw)
In-Reply-To: <20200123082106.GT795@breakpoint.cc>
On 1/23/20 9:21 AM, Florian Westphal wrote:
> Daniel Borkmann <daniel@iogearbox.net> wrote:
>> On 1/22/20 12:43 PM, Florian Westphal wrote:
>>> Daniel Borkmann <daniel@iogearbox.net> wrote:
>>>>> @@ -449,9 +464,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
>>>>> if (skb->ip_summed != CHECKSUM_PARTIAL) {
>>>>> *sum = csum_fold(csum_partial(diff, sizeof(diff),
>>>>> ~csum_unfold(*sum)));
>>>>> - if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
>>>>> - skb->csum = ~csum_partial(diff, sizeof(diff),
>>>>> - ~skb->csum);
>>>>
>>>> What is the technical rationale in removing this here but not in any of the
>>>> other inet_proto_csum_replace*() functions? You changelog has zero analysis
>>>> on why here but not elsewhere this change would be needed?
>>>
>>> Right, I think it could be dropped everywhere BUT there is a major caveat:
>>>
>>> At least for the nf_nat case ipv4 header manipulation (which uses the other
>>> helpers froum utils.c) will eventually also update iph->checksum field
>>> to account for the changed ip addresses.
>>>
>>> And that update doesn't touch skb->csum.
>>>
>>> So in a way the update of skb->csum in the other helpers indirectly account
>>> for later ip header checksum update.
>>>
>>> At least that was my conclusion when reviewing the earlier incarnation
>>> of the patch.
>>
>> Mainly asking because not inet_proto_csum_replace16() but the other ones are
>> exposed via BPF and they are all in no way fundamentally different to each
>> other, but my concern is that depending on how the BPF prog updates the csums
>> things could start to break. :/
>
> I'm reasonably sure removing the skb->csum update from the other
> helpers will also break ipv4 nat :)
>
> So, AFAIU from what you're saying above the patch seems fine as-is and
> just needs a more verbose commit message explaining why replace16()
> doesn't update skb->csum while all the other ones do.
>
> Is that correct?
Probably better a comment in the code to avoid confusion on why it's not done in
inet_proto_csum_replace16() but all the other cases; mainly to avoid some folks
in future sending random cleanup patches w/ removal attempts.
Thanks,
Daniel
next prev parent reply other threads:[~2020-01-23 14:21 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-06 22:52 [PATCH v3] [net]: Fix skb->csum update in inet_proto_csum_replace16() Praveen Chaudhary
2019-11-06 22:52 ` Praveen Chaudhary
2020-01-22 10:17 ` Daniel Borkmann
2020-01-22 11:43 ` Florian Westphal
2020-01-22 16:22 ` Daniel Borkmann
2020-01-23 8:21 ` Florian Westphal
2020-01-23 14:20 ` Daniel Borkmann [this message]
2020-01-23 14:29 ` Florian Westphal
2020-01-23 20:33 ` [PATCH v4] " Praveen Chaudhary
2020-01-23 20:33 ` Praveen Chaudhary
2020-01-24 19:04 ` Pablo Neira Ayuso
2020-01-23 20:50 ` [PATCH v3] " Praveen Chaudhary
2020-01-22 5:51 ` Praveen Chaudhary
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1c1fc75d-e69c-f2f6-78ce-de9dc8aa89ca@iogearbox.net \
--to=daniel@iogearbox.net \
--cc=astracner@linkedin.com \
--cc=davem@davemloft.net \
--cc=fw@strlen.de \
--cc=kadlec@netfilter.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=praveen5582@gmail.com \
--cc=zxu@linkedin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).