> On Thu, Jul 25, 2024 at 8:56 AM Ilya Maximets <i.maxim...@ovn.org> wrote:
> >
> > On 7/25/24 05:18, Jun Wang via discuss wrote:
> > > Hi,team.
> > > I used hping3 to send IPv4 packets and found that the checksum
> > > of the packet was incorrect when it carried the option field. After
> > > analyzing the code, I discovered that our IP checksum calculation
> > > does not consider the length of the options, leading to the
> > > checksum error. Are we not considering the IP options on purpose,
> > > or is there another consideration?
> > >
> > > Test command :
> > > hping3 -c 1000 -1 -G 10.252.246.164
> > >
> > > packet:
> > >
> > > 0000 58 53 c0 56 07 46 cc d8 1f 1b 7e 5e 81 00 00 5c
> > > 0010 08 00 45 00 00 76 00 00 40 00 3d 11 5d 33 0a fc
> > > 0020 e5 46 0a fc e5 05 e1 5c 12 b5 00 62 84 69 08 00
> > > 0030 00 00 00 00 64 00 02 7a 3b 9b c2 2a 58 53 c0 56
> > > 0040 07 60 08 00 4f 00 00 44 f0 e4 00 00 3e 01 7e 14
> > > 0050 0a fc f7 23 0a fc f6 a4 07 27 0c 01 02 03 04 0a
> > > 0060 fc e9 fc 00 00 00 00 00 00 00 00 00 00 00 00 00
> > > 0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> > > 0080 08 00 3e 2f b9 d0 00 00
> > >
> > >
> > > Calculation method:
> > >
> > > ip->ip_csum = csum(ip, sizeof *ip);
> > >
> >
> > The only place where we calculate IP checksum from scratch must
> > be the checksum offload code, i.e. dp_packet_ip_set_header_csum().
> > Are you using checksum offload?
> >
> > If so, I'd say it is a bug in the dp_packet_ip_set_header_csum()
> > function. It should use the length from the ip header.
>
> Yes, it looks like dp_packet_ip_set_header_csum doesn't use the
> correct length. It seems that the most problematic location where this
> function is used is in netdev_push_header(), which I believe is what's
> causing the problem here.
>
> I'll send in a patch for this.
>
> Thanks,
> Mike
Hello, Mike is correct. Most of our network cards do not support outer UDP
checksum offload, so the inner IP checksum offload is calculated in software.
When calling `dp_packet_ip_set_header_csum for calculation`, it does not take
IP options into account, resulting in an incorrect IP checksum.
>
> >
> > In general, OVS doesn't actually support IP options. It doesn't
> > parse them and doesn't act on them. But it should allow packets
> > with options to pass through.
> >
> > Best regards, Ilya Maximets.
> >
Jun Wang
_______________________________________________
discuss mailing list
disc...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-discuss
