The TCP/UDP connection-tracking code in netfilter validates the
checksum of incoming packets, to prevent nastier errors further down
the road. This check is unnecessary if the skb is marked as
CHECKSUM_UNNECESSARY.
This patch will improve performance for networkinterfaces that perform
CHECKSUM_UNNECESSARY-style checksum offload (that's most modern
ones). More importantly (for me :-)) is that this makes netfilter play
nicely with checksum avoidance in the Xen virtual machine
monitor. Inter-domain traffic has no checksum calculated, so
validation checks will fail even though the packet data is good.
Of course, this avoidance relies on the network stack respecting
CHECKSUM_UNNECESSARY.
Signed-off-by: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2005-05-27
11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
2005-05-27 11:48:07 +01:00
@@ -803,6 +803,7 @@
*/
/* FIXME: Source route IP option packets --RR */
if (hooknum == NF_IP_PRE_ROUTING
+ && skb->ip_summed != CHECKSUM_UNNECESSARY
&& csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
skb->ip_summed == CHECKSUM_HW ? skb->csum
: skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c
linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2005-05-27
11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
2005-05-27 11:48:07 +01:00
@@ -120,6 +120,7 @@
* and moreover root might send raw packets.
* FIXME: Source route IP option packets --RR */
if (hooknum == NF_IP_PRE_ROUTING
+ && skb->ip_summed != CHECKSUM_UNNECESSARY
&& csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
skb->ip_summed == CHECKSUM_HW ? skb->csum
: skb_checksum(skb, iph->ihl*4, udplen, 0))) {
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|
Home