kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

net: Implmement RFC 6936 (zero RX csums for UDP/IPv6)

Browse source 
RFC 6936 relaxes the requirement of RFC 2460 that UDP/IPv6 packets which
are received with a zero UDP checksum value must be dropped. RFC 6936
allows zero checksums to support tunnels over UDP.

When sk_no_check is set we allow on a socket we allow a zero IPv6
UDP checksum. This is for both sending zero checksum and accepting
a zero checksum on receive.

Signed-off-by: Tom Herbert <therbert@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Tom Herbert 2014-05-02 16:29:58 -07:00 committed by David S. Miller
parent e4f45b7f40
commit 4068579e1e
2 changed files with 38 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
net/ipv6/ip6_checksum.c
View file

@ -75,16 +75,12 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
return err; return err;
} }
if (uh->check == 0) { /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
/* RFC 2460 section 8.1 says that we SHOULD log * we accept a checksum of zero here. When we find the socket
this error. Well, it is reasonable. * for the UDP packet we'll check if that socket allows zero checksum
*/ * for IPv6 (set by socket option).
LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0 for [%pI6c]:%u->[%pI6c]:%u\n", */
&ipv6_hdr(skb)->saddr, ntohs(uh->source), return skb_checksum_init_zero_check(skb, proto, uh->check,
&ipv6_hdr(skb)->daddr, ntohs(uh->dest)); ip6_compute_pseudo);
return 1;
}
return skb_checksum_init(skb, IPPROTO_UDP, ip6_compute_pseudo);
} }
EXPORT_SYMBOL(udp6_csum_init); EXPORT_SYMBOL(udp6_csum_init);

33
net/ipv6/udp.c
View file

@ -760,6 +760,17 @@ static void flush_stack(struct sock **stack, unsigned int count,
if (unlikely(skb1)) if (unlikely(skb1))
kfree_skb(skb1); kfree_skb(skb1);
} }
static void udp6_csum_zero_error(struct sk_buff *skb)
{
/* RFC 2460 section 8.1 says that we SHOULD log
* this error. Well, it is reasonable.
*/
LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0 for [%pI6c]:%u->[%pI6c]:%u\n",
&ipv6_hdr(skb)->saddr, ntohs(udp_hdr(skb)->source),
&ipv6_hdr(skb)->daddr, ntohs(udp_hdr(skb)->dest));
}
/* /*
* Note: called only from the BH handler context, * Note: called only from the BH handler context,
* so we don't need to lock the hashes. * so we don't need to lock the hashes.
@ -779,7 +790,12 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
dif = inet6_iif(skb); dif = inet6_iif(skb);
sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif); sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
while (sk) { while (sk) {
stack[count++] = sk; /* If zero checksum and sk_no_check is not on for
* the socket then skip it.
*/
if (uh->check || sk->sk_no_check)
stack[count++] = sk;
sk = udp_v6_mcast_next(net, sk_nulls_next(sk), uh->dest, daddr, sk = udp_v6_mcast_next(net, sk_nulls_next(sk), uh->dest, daddr,
uh->source, saddr, dif); uh->source, saddr, dif);
if (unlikely(count == ARRAY_SIZE(stack))) { if (unlikely(count == ARRAY_SIZE(stack))) {
@ -867,6 +883,11 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
if (sk != NULL) { if (sk != NULL) {
int ret; int ret;
if (!uh->check && !sk->sk_no_check) {
udp6_csum_zero_error(skb);
goto csum_error;
}
ret = udpv6_queue_rcv_skb(sk, skb); ret = udpv6_queue_rcv_skb(sk, skb);
sock_put(sk); sock_put(sk);
@ -879,6 +900,11 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
return 0; return 0;
} }
if (!uh->check) {
udp6_csum_zero_error(skb);
goto csum_error;
}
if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
goto discard; goto discard;
@ -1006,7 +1032,10 @@ static int udp_v6_push_pending_frames(struct sock *sk)
if (is_udplite) if (is_udplite)
csum = udplite_csum_outgoing(sk, skb); csum = udplite_csum_outgoing(sk, skb);
else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */ else if (sk->sk_no_check == UDP_CSUM_NOXMIT) { /* UDP csum disabled */
skb->ip_summed = CHECKSUM_NONE;
goto send;
} else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr, udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr,
up->len); up->len);
goto send; goto send;