NetBSD Problem Report #47849

From msaitoh@execsw.org  Thu May 23 16:40:43 2013
Return-Path: <msaitoh@execsw.org>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "Postmaster NetBSD.org" (verified OK))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 08C48717D5
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 23 May 2013 16:40:43 +0000 (UTC)
Message-Id: <20130523163853.75FE743985F@vslock.execsw.org>
Date: Fri, 24 May 2013 01:38:53 +0900 (JST)
From: msaitoh@execsw.org
Reply-To: msaitoh@execsw.org
To: gnats-bugs@gnats.NetBSD.org
Subject: ip6flow_fastforward() desn't clear csum_flags
X-Send-Pr-Version: 3.95

>Number:         47849
>Category:       kern
>Synopsis:       ip6flow_fastforward() desn't clear csum_flags
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    msaitoh
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu May 23 16:45:00 +0000 2013
>Closed-Date:    Wed Jun 19 08:19:44 +0000 2013
>Last-Modified:  Wed Jun 19 08:19:44 +0000 2013
>Originator:     SAITOH Masanobu
>Release:        NetBSD 6.x and 5.x
>Organization:
>Environment:
Architecture: all
Machine: all
>Description:
	ip6flow_fastforward() doesn't clear csum_flags in a mbuf.
	ipflow_fastforward() does it. If an outgoing interface doesn't
	support hwcsum, the checksum will be corrupted. If an outgoing
	interface support hwcsum and not enabled, packet may be corrupt.

                               wm1       wm0
                                         with UDP6CSUM_Rx
	[machineA]--------------[machineB]-----------------[machineC]
	                      NetBSD-current

        wm0: UDP6CSUM_Rx is set
	wm1: enabled = 0

	On machineC: tracetoute6 machineA

        > 1  machineB  2.023 ms  1.991 ms  1.598 ms
        > 2  machineA  2.052 ms *  1.551 ms   (<=== 2nd try failed)

	tcpdump's output on machineA:

% tcpdump -vvX -s0 -i lan0 host 2001:240:694:1:230:48ff:fed8:c268
tcpdump: listening on lan0, link-type EN10MB (Ethernet), capture size 65535 bytes
01:32:58.306827 2001:240:694:1:230:48ff:fed8:c268.65494 > 2001:240:694::1.33438: [udp sum ok] UDP, length: 12 [hlim 1] (len 20)
        0x0000:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0010:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0020:  0000 0000 0000 0001 ffd6 829e 0014 49f7  ..............I.
        0x0030:  0402 0000 519e 44ba 0004 3ade            ....Q.D...:.
01:32:58.306979 2001:240:694::1 > 2001:240:694:1:230:48ff:fed8:c268: [icmp6 sum ok] icmp6: 2001:240:694::1 udp port 33438 unreachable (len 68, hlim 64)
        0x0000:  6000 0000 0044 3a40 2001 0240 0694 0000  `....D:@...@....
        0x0010:  0000 0000 0000 0001 2001 0240 0694 0001  ...........@....
        0x0020:  0230 48ff fed8 c268 0104 2f70 0000 0000  .0H....h../p....
        0x0030:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0040:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0050:  0000 0000 0000 0001 ffd6 829e 0014 49f7  ..............I.
        0x0060:  0402 0000 519e 44ba 0004 3ade            ....Q.D...:.
01:32:58.310089 65494 > 33439: UDP, length: 12 [class 0xf0] [flowlabel 0xf0000] [hlim 1] (len 20)
        0x0000:  8f0f 0000 0014 1101 2001 0240 0694 0001  ...........@....

        XXXXXXXXXXXXXXXXXXXXX IPv8 ?


        0x0010:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0020:  0000 0000 0000 0001 ffd6 829f 0014 3d9a  ..............=.
        0x0030:  0502 0000 519e 44ba 0004 463a            ....Q.D...F:
01:33:13.304245 2001:240:694:1:230:48ff:fed8:c268.65494 > 2001:240:694::1.33440: [udp sum ok] UDP, length: 12 [hlim 1] (len 20)
        0x0000:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0010:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0020:  0000 0000 0000 0001 ffd6 82a0 0014 52d2  ..............R.
        0x0030:  0602 0000 519e 44c9 0004 2ff2            ....Q.D.../.
01:33:13.304405 2001:240:694::1 > 2001:240:694:1:230:48ff:fed8:c268: [icmp6 sum ok] icmp6: 2001:240:694::1 udp port 33440 unreachable (len 68, hlim 64)
        0x0000:  6000 0000 0044 3a40 2001 0240 0694 0000  `....D:@...@....
        0x0010:  0000 0000 0000 0001 2001 0240 0694 0001  ...........@....
        0x0020:  0230 48ff fed8 c268 0104 2f70 0000 0000  .0H....h../p....
        0x0030:  6000 0000 0014 1101 2001 0240 0694 0001  `..........@....
        0x0040:  0230 48ff fed8 c268 2001 0240 0694 0000  .0H....h...@....
        0x0050:  0000 0000 0000 0001 ffd6 82a0 0014 52d2  ..............R.
        0x0060:  0602 0000 519e 44c9 0004 2ff2            ....Q.D.../.
^C


>How-To-Repeat:
	see above
>Fix:
	Patch:

Index: ip6_flow.c
===================================================================
RCS file: /cvsroot/src/sys/netinet6/ip6_flow.c,v
retrieving revision 1.20
diff -u -r1.20 ip6_flow.c
--- ip6_flow.c	11 Oct 2012 20:05:50 -0000	1.20
+++ ip6_flow.c	23 May 2013 12:46:23 -0000
@@ -288,6 +288,11 @@
 		return 0;
 	}

+	/*
+	 * Clear any in-bound checksum flags for this packet.
+	 */
+	m->m_pkthdr.csum_flags = 0;
+
 	if (ip6->ip6_hlim <= IPV6_HLIMDEC)
 		return 0;


>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->msaitoh
Responsible-Changed-By: msaitoh@NetBSD.org
Responsible-Changed-When: Thu, 23 May 2013 16:46:30 +0000
Responsible-Changed-Why:
mine.


From: "SAITOH Masanobu" <msaitoh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47849 CVS commit: src/sys/netinet6
Date: Thu, 23 May 2013 16:49:46 +0000

 Module Name:	src
 Committed By:	msaitoh
 Date:		Thu May 23 16:49:46 UTC 2013

 Modified Files:
 	src/sys/netinet6: ip6_flow.c

 Log Message:
 Clear mbuf's csum_flags in ip6flow_fastforward(). Fixes PR#47849.


 To generate a diff of this commit:
 cvs rdiff -u -r1.20 -r1.21 src/sys/netinet6/ip6_flow.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47849 CVS commit: [netbsd-6] src/sys/netinet6
Date: Wed, 19 Jun 2013 07:29:05 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Wed Jun 19 07:29:05 UTC 2013

 Modified Files:
 	src/sys/netinet6 [netbsd-6]: ip6_flow.c

 Log Message:
 Pull up following revision(s) (requested by msaitoh in ticket #895):
 	sys/netinet6/ip6_flow.c: revision 1.21
 Clear mbuf's csum_flags in ip6flow_fastforward(). Fixes PR#47849.


 To generate a diff of this commit:
 cvs rdiff -u -r1.19.2.1 -r1.19.2.2 src/sys/netinet6/ip6_flow.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47849 CVS commit: [netbsd-5] src/sys/netinet6
Date: Wed, 19 Jun 2013 08:01:06 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Wed Jun 19 08:01:05 UTC 2013

 Modified Files:
 	src/sys/netinet6 [netbsd-5]: ip6_flow.c

 Log Message:
 Pull up following revision(s) (requested by msaitoh in ticket #1864):
 	sys/netinet6/ip6_flow.c: revision 1.21
 Clear mbuf's csum_flags in ip6flow_fastforward(). Fixes PR#47849.


 To generate a diff of this commit:
 cvs rdiff -u -r1.17 -r1.17.10.1 src/sys/netinet6/ip6_flow.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: msaitoh@NetBSD.org
State-Changed-When: Wed, 19 Jun 2013 08:19:44 +0000
State-Changed-Why:
Fixed and pulled up to netbsd-[56].


>Unformatted:

Home	PR Database Search