WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] Xen checksumming bug with IPsec ESP packets

To: "Jonathan M. McCune" <jonmccune@xxxxxxx>
Subject: Re: [Xen-devel] Xen checksumming bug with IPsec ESP packets
From: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Date: Wed, 3 Aug 2005 18:01:20 +0100
Cc: caceres@xxxxxxxxxx, xen-devel@xxxxxxxxxxxxxxxxxxx, jaegert@xxxxxxxxxx, sailer@xxxxxxxxxx
Delivery-date: Wed, 03 Aug 2005 16:55:24 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <42F0F054.9030003@xxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <42F0F054.9030003@xxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

On 3 Aug 2005, at 17:27, Jonathan M. McCune wrote:

We fixed this by removing the addition of flag NETIF_F_IP_CSUM in drivers/xen/netfront/netfront.c:create_netdev(). I believe this tells the kernel to just always do the checksum in software. Thus, the broken optimization for TCP/UDP packets gets bypassed.


Permanent Solution:

???

That's why I posted this message... :-)

I suspect the ESP code would need to be made aware of the csum_blank field, and fill in before forwarding. There are doubtless other paths that may need similar tweaks (e.g., NAT IP masquerading is untested I think, although there's a fair chance it'll just work).

Apart from the above 'proper fix', simple not-so-hacky solutions include:
 * Run 'ethtool -K tx off' in each domU
* Add an option to netback in domain0 to fill in checksums itself if not done by domU. * Allow netback to advertise to domUs whether it accepts non-checksummed packets, and have an option to set this advertisement when you start netback.

 -- Keir


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

<Prev in Thread] Current Thread [Next in Thread>