From nobody Sun Sep 14 20:34:41 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4cQ0Jd6MVlz67RJ1; Sun, 14 Sep 2025 20:34:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4cQ0Jd5ltcz41Yp; Sun, 14 Sep 2025 20:34:41 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1757882081; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=95LLemNUR3EW+eJ8xuug5hf1xKGRQTjKPR1s4bexHSk=; b=mhgjKM1XPTvs/+UeTXmqC0Xv4z3ZWoi4x4kZPOtgUp4QJaT4bWFsiWHBtH+r5KKc4UsEQq Y9gVxaWDVYPOkxQql+wIIok/IvnO0k/DYCqNDrI/SsSL7XvUw+SmE40++n7O0ALH+YyP5b 2eV7HScDBpyhj/5az3UtDM+X/xGMK+W5wM+3IJ2qA0A3lmyu+V19sxSlE+cgAOTaFDLh2r py5CgOzqv/2DiBG+jyy1hlh4oVy0POOPFiKp6BqQE7VJMQOXiEfyMwN/uLjc6oMIqbW2ZC Yk/qkTPKxd1Sq/XSXbxN1Yrm1gvKGycsGImFqdT/DYHPUkD1aFF7wjk8Zht3Yw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1757882081; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=95LLemNUR3EW+eJ8xuug5hf1xKGRQTjKPR1s4bexHSk=; b=D8UZUFh8OvedrvR3o+8vdxq1CsNAFdNYHEtDRjSB//7K0Qh7yvCmlQzxYEdl1clOyMS1O5 kcvDw6RcljF0I+EDGa/EzmLPSpxlsRPCDW6/x+LsmRkFRampkGATF21bBxWMylPimDmRiS pJJ9/8zGvmld8Q3vXPO+JJAhlmciOqE9kqvhShbJVh/sbVmbKXEuLjW6I7DwJLORv7pwiq 0eQq/nhD2eElsfOqWv1n5OUDOrALxoTidXJbK0D+GRIIlmZdiWkKBPTr3e1Cmf7QuaMo5P xPtPAEHT0k11fbuqVIJwCXSdNoP1My/CxUIkGUJMHRPsc6tAB5uLN+dniYNjjg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1757882081; a=rsa-sha256; cv=none; b=swYCY9T6aDh/dAkO5CXWxkcLEzkvrvVJKexcC3TR0yVtkp2PiC1G3SJV/PxO8LPqgre+NI I9NUSNQJ6HLkUnh3MESDWO6UXIc5E/BvBo38AGkCRbqJJ4DFa2Lt74lV2LiQBzUQ9+L2Vv /Wz+AQXcFysd6vj5tE1yn9vlmioUcFq8LGjjuRcGSagZVvPMAB7veXbdj3WZIKCWgj8zfJ Gvv+Ognegc0tjFLobYRUEDxIRcI3DhVx8RDXFHqpu1EpEZ68TA3b14KUazKdt7qRGHNQUg W6//5j8aWagETkMmAZj419jzSoyFXR08IIm1+tPlAWup7ddorbvFF/GGxe5VNQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4cQ0Jd5KT7z8hJ; Sun, 14 Sep 2025 20:34:41 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 58EKYfMJ003347; Sun, 14 Sep 2025 20:34:41 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 58EKYfB7003344; Sun, 14 Sep 2025 20:34:41 GMT (envelope-from git) Date: Sun, 14 Sep 2025 20:34:41 GMT Message-Id: <202509142034.58EKYfB7003344@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Michael Tuexen Subject: git: ffd956a3918c - stable/14 - dhclient: improve UDP checksum handling List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: ffd956a3918cd5e64c8850eb77247428a29f7221 Auto-Submitted: auto-generated The branch stable/14 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=ffd956a3918cd5e64c8850eb77247428a29f7221 commit ffd956a3918cd5e64c8850eb77247428a29f7221 Author: Michael Tuexen AuthorDate: 2025-09-10 15:13:35 +0000 Commit: Michael Tuexen CommitDate: 2025-09-14 20:33:24 +0000 dhclient: improve UDP checksum handling When sending UDP packets: * compute the checksum in the correct order. This only has an impact if the length of the payload is odd. * don't send packet with a checksum of zero, use 0xffff instead as required. When receiving UDP packets: * don't do any computations when the checksum is zero. * compute the checksum in the correct order. This only has an impact if the length of the payload is odd. * when computing the checksum, store the pseudo header checksum * if the checksum is computed as zero, use 0xffff instead. * also accept packets, when the checksum in the packet is the pseudo header checksum. The last point fixes a problem when the DHCP client runs in a VM, the DHCP server runs on the host serving the VM and the network interface supports transmit checksum offloading. Since dhclient doesn't use UDP sockets but bpf devices to read the packets, the checksum will be incorrect and only contain the checksum of the pseudo header. PR: 263229 Reviewed by: markj, Timo Völker Tested by: danilo Differential Revision: https://reviews.freebsd.org/D52394 (cherry picked from commit 187ee62c71f2be62870f26ae98de865e330121be) --- sbin/dhclient/packet.c | 53 +++++++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 18 deletions(-) diff --git a/sbin/dhclient/packet.c b/sbin/dhclient/packet.c index 3d7390c06ee0..fc0305a8cb0c 100644 --- a/sbin/dhclient/packet.c +++ b/sbin/dhclient/packet.c @@ -135,11 +135,14 @@ assemble_udp_ip_header(unsigned char *buf, int *bufix, u_int32_t from, udp.uh_ulen = htons(sizeof(udp) + len); memset(&udp.uh_sum, 0, sizeof(udp.uh_sum)); - udp.uh_sum = wrapsum(checksum((unsigned char *)&udp, sizeof(udp), - checksum(data, len, checksum((unsigned char *)&ip.ip_src, + udp.uh_sum = wrapsum(checksum(data, len, checksum((unsigned char *)&udp, + sizeof(udp), checksum((unsigned char *)&ip.ip_src, 2 * sizeof(ip.ip_src), IPPROTO_UDP + (u_int32_t)ntohs(udp.uh_ulen))))); + if (udp.uh_sum == htons(0)) + udp.uh_sum = htons(0xffff); + memcpy(&buf[*bufix], &udp, sizeof(udp)); *bufix += sizeof(udp); } @@ -166,7 +169,7 @@ decode_udp_ip_header(unsigned char *buf, int bufix, struct sockaddr_in *from, struct ip *ip; struct udphdr *udp; u_int32_t ip_len = (buf[bufix] & 0xf) << 2; - u_int32_t sum, usum; + u_int32_t sum, usum, pseudo_sum; static int ip_packets_seen; static int ip_packets_bad_checksum; static int udp_packets_seen; @@ -224,23 +227,37 @@ decode_udp_ip_header(unsigned char *buf, int bufix, struct sockaddr_in *from, } usum = udp->uh_sum; - udp->uh_sum = 0; - - sum = wrapsum(checksum((unsigned char *)udp, sizeof(*udp), - checksum(data, len, checksum((unsigned char *)&ip->ip_src, - 2 * sizeof(ip->ip_src), - IPPROTO_UDP + (u_int32_t)ntohs(udp->uh_ulen))))); - udp_packets_seen++; - if (usum && usum != sum) { - udp_packets_bad_checksum++; - if (udp_packets_seen > 4 && udp_packets_bad_checksum != 0 && - (udp_packets_seen / udp_packets_bad_checksum) < 2) { - note("%d bad udp checksums in %d packets", - udp_packets_bad_checksum, udp_packets_seen); - udp_packets_seen = udp_packets_bad_checksum = 0; + + if (usum != htons(0)) { + udp->uh_sum = 0; + + pseudo_sum = checksum((unsigned char *)&ip->ip_src, + 2 * sizeof(ip->ip_src), + IPPROTO_UDP + (u_int32_t)ntohs(udp->uh_ulen)); + sum = wrapsum(checksum(data, len, + checksum((unsigned char *)udp, sizeof(*udp), pseudo_sum))); + if (sum == htons(0)) + sum = htons(0xffff); + + /* + * In addition to accepting UDP packets with the correct + * checksum in the checksum field, accept also the ones which + * have the correct pseudo header checksum in the checksum + * field. This allows to process UDP packets, which have been + * marked for transmit checksum offloading by the sender side. + */ + if (usum != sum && usum != htons(pseudo_sum & 0x0000ffff)) { + udp_packets_bad_checksum++; + if (udp_packets_seen > 4 && + udp_packets_bad_checksum != 0 && + (udp_packets_seen / udp_packets_bad_checksum) < 2) { + note("%d bad udp checksums in %d packets", + udp_packets_bad_checksum, udp_packets_seen); + udp_packets_seen = udp_packets_bad_checksum = 0; + } + return (-1); } - return (-1); } memcpy(&from->sin_port, &udp->uh_sport, sizeof(udp->uh_sport));