IP checksum broken in 2.2 .18 ip_decrease_ttl

IP checksum broken in 2.2 .18 ip_decrease_ttl

[Ulrich.Weigand]

Hi Alan,

the fast IP checksum update in ip_decrease_ttl appears
to be broken (at least on big endian machines) since 2.2.18.

Even on little endian machines IMO the overflow is incorrect
in two cases:

  0xfeff goes to 0x0000 instead of 0xffff
  0xffff goes to 0x0000 instead of 0x0100

On big endian machines, the overflow from the high byte
is never carried over correctly:

  0xfeff goes to 0x0000 instead of 0xffff
  0xff00 goes to 0x0000 instead of 0x0001
  0xff01 goes to 0x0001 instead of 0x0002
  ...
  0xffff goes to 0x00ff instead of 0x0100


The following patch reverts the ip_decrease_ttl routine
to the pre-2.2.18 level, which might be less efficient,
but should at least be correct ...

diff -urN linux-2.2.19/include/net/ip.h linux-2.2.19-s390/include/net/ip.h
--- linux-2.2.19/include/net/ip.h  Sun Mar 25 18:37:40 2001
+++ linux-2.2.19-s390/include/net/ip.h   Wed May 16 14:51:03 2001
@@ -171,8 +171,10 @@
 int ip_decrease_ttl(struct iphdr *iph)
 {
     u16 check = iph->check;
-    check += __constant_htons(0x0100);
-    iph->check = check + ((check>=0xFFFF) ? 1 : 0);
+    check = ntohs(check) + 0x0100;
+    if ((check & 0xFF00) == 0)
+         check++;                /* carry overflow */
+    iph->check = htons(check);
     return --iph->ttl;
 }



Mit freundlichen Gruessen / Best Regards

Ulrich Weigand

--
  Dr. Ulrich Weigand
  Linux for S/390 Design & Development
  IBM Deutschland Entwicklung GmbH, Schoenaicher Str. 220, 71032 Boeblingen
  Phone: +49-7031/16-3727   ---   Email: Ulrich.Weigand@de.ibm.com

Re: IP checksum broken in 2.2 .18 ip_decrease_ttl

[David S. Miller]

Fixed in the current sources, this was already fixed in 2.4.x

Later,
David S. Miller
davem@redhat.com