Re: [PATCH] ipvs: Fix checksumming on GSO of SCTP packets

[Julian Anastasov <ja@xxxxxx>]

        Hello,

On Thu, 18 Apr 2024, Ismael Luceno wrote:

> It was observed in the wild that pairs of consecutive packets would leave
> the IPVS with the same wrong checksum, and the issue only went away when
> disabling GSO.
> 
> IPVS needs to avoid computing the SCTP checksum when using GSO.
> 
> Co-developed-by: Firo Yang <firo.yang@xxxxxxxx>
> Signed-off-by: Ismael Luceno <iluceno@xxxxxxx>
> Tested-by: Andreas Taschner <andreas.taschner@xxxxxxxx>
> CC: Michal Kubeček <mkubecek@xxxxxxxx>
> CC: Simon Horman <horms@xxxxxxxxxxxx>
> CC: Julian Anastasov <ja@xxxxxx>
> CC: lvs-devel@xxxxxxxxxxxxxxx
> CC: netfilter-devel@xxxxxxxxxxxxxxx
> CC: netdev@xxxxxxxxxxxxxxx
> CC: coreteam@xxxxxxxxxxxxx

        Thanks for the fix, I'll accept this but skb_is_gso_sctp()
has comment for pre-condition: skb_is_gso(skb). Can you send v2
with it?

        I'm guessing what should be the Fixes line, may be?:

Fixes: 90017accff61 ("sctp: Add GSO support")

        because SCTP GSO was added after the IPVS code? Or the
more recent commit d02f51cbcf12 which adds skb_is_gso_sctp ?

> ---
>  net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c 
> b/net/netfilter/ipvs/ip_vs_proto_sctp.c
> index a0921adc31a9..3205b45ce161 100644
> --- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
> +++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
> @@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct 
> ip_vs_protocol *pp,
>       if (sctph->source != cp->vport || payload_csum ||
>           skb->ip_summed == CHECKSUM_PARTIAL) {
>               sctph->source = cp->vport;
> -             sctp_nat_csum(skb, sctph, sctphoff);
> +             if (!skb_is_gso_sctp(skb))
> +                     sctp_nat_csum(skb, sctph, sctphoff);
>       } else {
>               skb->ip_summed = CHECKSUM_UNNECESSARY;
>       }
> @@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct 
> ip_vs_protocol *pp,
>           (skb->ip_summed == CHECKSUM_PARTIAL &&
>            !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) {
>               sctph->dest = cp->dport;
> -             sctp_nat_csum(skb, sctph, sctphoff);
> +             if (!skb_is_gso_sctp(skb))
> +                     sctp_nat_csum(skb, sctph, sctphoff);
>       } else if (skb->ip_summed != CHECKSUM_PARTIAL) {
>               skb->ip_summed = CHECKSUM_UNNECESSARY;
>       }

Regards

--
Julian Anastasov <ja@xxxxxx>