Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964990AbbLSVed (ORCPT ); Sat, 19 Dec 2015 16:34:33 -0500 Received: from mail-yk0-f181.google.com ([209.85.160.181]:33470 "EHLO mail-yk0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751658AbbLSVec (ORCPT ); Sat, 19 Dec 2015 16:34:32 -0500 MIME-Version: 1.0 In-Reply-To: References: Date: Sat, 19 Dec 2015 13:34:31 -0800 Message-ID: Subject: Re: [PATCH] veth: don't modify ip-summed; doing so treats packets with bad checksums as good. From: Cong Wang To: Cong Wang Cc: Vijay Pandurangan , Nicolas Dichtel , Phil Sutter , Toshiaki Makita , Linux Kernel Network Developers , LKML , Evan Jones , Tom Herbert Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1607 Lines: 41 On Sat, Dec 19, 2015 at 1:01 PM, Cong Wang wrote: > On Fri, Dec 18, 2015 at 11:42 AM, Vijay Pandurangan wrote: >> Evan and I have demonstrated this bug on Kubernetes as well, so it's >> not just a problem in Mesos. (See >> https://github.com/kubernetes/kubernetes/issues/18898) >> > > Interesting... then this problem is much more serious than I thought. > > Looks like in RX path the bridge sets the checksum to CHECKSUM_NONE > too: > > static inline void skb_forward_csum(struct sk_buff *skb) > { > /* Unfortunately we don't support this one. Any brave souls? */ > if (skb->ip_summed == CHECKSUM_COMPLETE) > skb->ip_summed = CHECKSUM_NONE; > } > > I guess this is probably why Docker/Kubernetes could be affected too. Hmm, no, actually this is due to netem does the software checksum and sets it to CHECKSUM_NONE: if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) { if (!(skb = skb_unshare(skb, GFP_ATOMIC)) || (skb->ip_summed == CHECKSUM_PARTIAL && skb_checksum_help(skb))) return qdisc_drop(skb, sch); skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8); } But anyway, your patch still looks correct to me. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/