From: Keir Fraser <Keir.Fraser@cl.cam.ac.uk>
To: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xensource.com, Keir.Fraser@cl.cam.ac.uk,
cedric@schieli.dyndns.org, coreteam@netfilter.org
Subject: [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter
Date: Fri, 27 May 2005 12:03:08 +0100 [thread overview]
Message-ID: <E1DbccR-00063Q-00@mta1.cl.cam.ac.uk> (raw)
[-- Attachment #1: Type: text/plain, Size: 750 bytes --]
The TCP/UDP connection-tracking code in netfilter validates the
checksum of incoming packets, to prevent nastier errors further down
the road. This check is unnecessary if the skb is marked as
CHECKSUM_UNNECESSARY.
This patch will improve performance for networkinterfaces that perform
CHECKSUM_UNNECESSARY-style checksum offload (that's most modern
ones). More importantly (for me :-)) is that this makes netfilter play
nicely with checksum avoidance in the Xen virtual machine
monitor. Inter-domain traffic has no checksum calculated, so
validation checks will fail even though the packet data is good.
Of course, this avoidance relies on the network stack respecting
CHECKSUM_UNNECESSARY.
Signed-off-by: Keir Fraser <Keir.Fraser@xl.cam.ac.uk>
[-- Attachment #2: Checksum patch --]
[-- Type: text/plain, Size: 1351 bytes --]
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2005-05-27 11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 2005-05-27 11:48:07 +01:00
@@ -803,6 +803,7 @@
*/
/* FIXME: Source route IP option packets --RR */
if (hooknum == NF_IP_PRE_ROUTING
+ && skb->ip_summed != CHECKSUM_UNNECESSARY
&& csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
skb->ip_summed == CHECKSUM_HW ? skb->csum
: skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2005-05-27 11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c 2005-05-27 11:48:07 +01:00
@@ -120,6 +120,7 @@
* and moreover root might send raw packets.
* FIXME: Source route IP option packets --RR */
if (hooknum == NF_IP_PRE_ROUTING
+ && skb->ip_summed != CHECKSUM_UNNECESSARY
&& csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
skb->ip_summed == CHECKSUM_HW ? skb->csum
: skb_checksum(skb, iph->ihl*4, udplen, 0))) {
next reply other threads:[~2005-05-27 11:03 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-05-27 11:03 Keir Fraser [this message]
2005-05-27 11:20 ` Phil Oester
2005-05-28 8:48 ` Keir Fraser
2005-06-12 15:06 ` [netfilter-core] " Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E1DbccR-00063Q-00@mta1.cl.cam.ac.uk \
--to=keir.fraser@cl.cam.ac.uk \
--cc=cedric@schieli.dyndns.org \
--cc=coreteam@netfilter.org \
--cc=linux-kernel@vger.kernel.org \
--cc=xen-devel@lists.xensource.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®