[Xen-devel] [PATCH] Avoid unncessary checksum validation in TCP/UDP netfilter

[Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>]

The TCP/UDP connection-tracking code in netfilter validates the
checksum of incoming packets, to prevent nastier errors further down
the road. This check is unnecessary if the skb is marked as
CHECKSUM_UNNECESSARY. 

This patch will improve performance for networkinterfaces that perform
CHECKSUM_UNNECESSARY-style checksum offload (that's most modern
ones). More importantly (for me :-)) is that this makes netfilter play
nicely with checksum avoidance in the Xen virtual machine
monitor. Inter-domain traffic has no checksum calculated, so
validation checks will fail even though the packet data is good.
Of course, this avoidance relies on the network stack respecting
CHECKSUM_UNNECESSARY.

Signed-off-by: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>

diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c 
linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_tcp.c    2005-05-27 
11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_tcp.c       
2005-05-27 11:48:07 +01:00
@@ -803,6 +803,7 @@
         */
        /* FIXME: Source route IP option packets --RR */
        if (hooknum == NF_IP_PRE_ROUTING
+           && skb->ip_summed != CHECKSUM_UNNECESSARY
            && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
                                 skb->ip_summed == CHECKSUM_HW ? skb->csum
                                 : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
diff -ur linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c 
linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c
--- linux-2.6.11/net/ipv4/netfilter/ip_conntrack_proto_udp.c    2005-05-27 
11:47:48 +01:00
+++ linux-2.6.11-csum/net/ipv4/netfilter/ip_conntrack_proto_udp.c       
2005-05-27 11:48:07 +01:00
@@ -120,6 +120,7 @@
         * and moreover root might send raw packets.
         * FIXME: Source route IP option packets --RR */
        if (hooknum == NF_IP_PRE_ROUTING
+           && skb->ip_summed != CHECKSUM_UNNECESSARY
            && csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
                                 skb->ip_summed == CHECKSUM_HW ? skb->csum
                                 : skb_checksum(skb, iph->ihl*4, udplen, 0))) {

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel