2005-05-27 11:03:18

by Keir Fraser

Subject: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2005-05-27 11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2005-05-27 11:48:07 +01:00
@@ -803,6 +803,7 @@
*/
/* FIXME: Source route IP option packets --RR */
if (hooknum == NF_IP_PRE_ROUTING
+ && skb->ip_summed != CHECKSUM_UNNECESSARY
&& csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
skb->ip_summed == CHECKSUM_HW ? skb->csum
: skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2005-05-27 11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2005-05-27 11:48:07 +01:00
@@ -120,6 +120,7 @@
* and moreover root might send raw packets.
* FIXME: Source route IP option packets --RR */
if (hooknum == NF_IP_PRE_ROUTING
+ && skb->ip_summed != CHECKSUM_UNNECESSARY
&& csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
skb->ip_summed == CHECKSUM_HW ? skb->csum
: skb_checksum(skb, iph->ihl*4, udplen, 0))) {

2005-05-27 11:20:45

by Phil Oester

Subject: Re: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

On Fri, May 27, 2005 at 12:03:08PM +0100, Keir Fraser wrote:
> The TCP/UDP connection-tracking code in netfilter validates the
> checksum of incoming packets, to prevent nastier errors further down
> the road. This check is unnecessary if the skb is marked as
> CHECKSUM_UNNECESSARY.

It seems at least part of this has already been merged in 2.6.12-rc

http://www.kernel.org/git/gitweb.cgi?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;h=721ddbf522b422d554479a7ab15c0955798f16ee;hp=2b87c1974be605d5bdb1ee769188d7e03fb2ddc8;hb=31da185d8162ae0f30a13ed945f1f4d28d158133;f=net/ipv4/netfilter/ip_conntrack_proto_tcp.c

Phil

2005-05-28 08:52:21

by Keir Fraser

Subject: Re: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

On 27 May 2005, at 12:20, Phil Oester wrote:

> On Fri, May 27, 2005 at 12:03:08PM +0100, Keir Fraser wrote:
>> The TCP/UDP connection-tracking code in netfilter validates the
>> checksum of incoming packets, to prevent nastier errors further down
>> the road. This check is unnecessary if the skb is marked as
>> CHECKSUM_UNNECESSARY.
>
> It seems at least part of this has already been merged in 2.6.12-rc

It would be great if the UDP code also would observe
CHECKSUM_UNNECESSARY. I'll wait for 2.6.12 to appear and then submit a
new patch if UDP has been missed.

Thanks,
Keir