From nobody Wed Sep 10 15:48:14 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4cMQ7z1Cbdz66WM1; Wed, 10 Sep 2025 15:48:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4cMQ7z0cZTz3J01; Wed, 10 Sep 2025 15:48:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1757519295; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9f384/SY2t6mzTpMMw5CudJc6+SXKWI8IhQFP/Ktif8=; b=FEbL/paoDnIWfPDDMo+7GXCNWEtjpJCAhl9YBfsC6OkCPXWUP2oyo7fLaSEjTv4zl4unWa 5w6cydaRAbdFLvEIoWgCis2SG9bX1u8fwHd3Hc4TwSBZU0wqoAfIXnjVECW2N8U4NTg1Vb oZe8udFqRyTfHWJBkiT0M4qqKuACtYz4JahQ7AlvyOs89BD5rwonU7BzN030spWZpkHjP+ 2TlnT4grHBtbv7Dh+vLRZRyzLa25o0ZJeZkIbYSNCcGmsvA1pvquUVCSRfUOXt/2QCEf04 dqzMbISudQAmcSnwLiDuwZvnCLj4LxF2UdtRAAsVVHNf7yOtPUSL8Rc1owFv+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1757519295; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9f384/SY2t6mzTpMMw5CudJc6+SXKWI8IhQFP/Ktif8=; b=AAS8ekW9lH2pbMfSdznC8CoCW2FlHrt5SBFXHhTbypMxJkeVuSkDhjy+456VyN12SyXebX FQGttjKF3WR7wnXCXT2UT7FQm/niDyb8qyeQ6lnYstvBOp0ObE1ay5XcVT0lOxM1FxWVnk YfjHdSGl5xg8dyBx38Rtcs4R3u0EzpweDu5I87qODm/PrxRjQaX6H55Q0D3MGARjqN9tGI s8KjX/t2fh1qt3AXy4pUf/CMY0qN6q/qRfFbh0nApk1SGvVGFHeUrc1g+qwitkYmbBNx4C 84EQibC8r1vkluw1pLc+C0SJfopEDaY4H+5n/TdrVNPUWAy5Db3+bRAojdAAHg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1757519295; a=rsa-sha256; cv=none; b=wtc+bGHsLWM4uL29a6Turjzfv8sctL3Ni9bocxlQxZmw7rBTfgqMj9MMefAyo5iQiYnJDg CjZfAgrnkcDjGAZbuGhJZ0N59Z+ra8x9MUDAklCcLXruQTjrNPARyxhQBwC/n8iUm+ffLl Qdh3sQcPVdUF7nhCeXVUAo2J057qViVHlfjioFjVgPUuZiuM2L/LFp9WieNBbj2KW88SRP T9BCTTt+gcnV9P3Z+N/6O/sg6CFh78djsB0L+0S3/1vKJL+cil+DBC+ZbbjudGp1kGEtWx B43CG3ivk71EQJIemb21nZQ+XNQJb6Iyc0FytQ+MVTOEpUTLk8TGtY/KUBMa7Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4cMQ7y73WfzBxZ; Wed, 10 Sep 2025 15:48:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 58AFmEf0029118; Wed, 10 Sep 2025 15:48:14 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 58AFmERd029115; Wed, 10 Sep 2025 15:48:14 GMT (envelope-from git) Date: Wed, 10 Sep 2025 15:48:14 GMT Message-Id: <202509101548.58AFmERd029115@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 187ee62c71f2 - main - dhclient: improve UDP checksum handling List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 187ee62c71f2be62870f26ae98de865e330121be Auto-Submitted: auto-generated The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=187ee62c71f2be62870f26ae98de865e330121be commit 187ee62c71f2be62870f26ae98de865e330121be Author: Michael Tuexen AuthorDate: 2025-09-10 15:13:35 +0000 Commit: Michael Tuexen CommitDate: 2025-09-10 15:19:23 +0000 dhclient: improve UDP checksum handling When sending UDP packets: * compute the checksum in the correct order. This only has an impact if the length of the payload is odd. * don't send packet with a checksum of zero, use 0xffff instead as required. When receiving UDP packets: * don't do any computations when the checksum is zero. * compute the checksum in the correct order. This only has an impact if the length of the payload is odd. * when computing the checksum, store the pseudo header checksum * if the checksum is computed as zero, use 0xffff instead. * also accept packets, when the checksum in the packet is the pseudo header checksum. The last point fixes a problem when the DHCP client runs in a VM, the DHCP server runs on the host serving the VM and the network interface supports transmit checksum offloading. Since dhclient doesn't use UDP sockets but bpf devices to read the packets, the checksum will be incorrect and only contain the checksum of the pseudo header. PR: 263229 Reviewed by: markj, Timo Völker Tested by: danilo MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D52394 --- sbin/dhclient/packet.c | 53 +++++++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 18 deletions(-) diff --git a/sbin/dhclient/packet.c b/sbin/dhclient/packet.c index 3d7390c06ee0..fc0305a8cb0c 100644 --- a/sbin/dhclient/packet.c +++ b/sbin/dhclient/packet.c @@ -135,11 +135,14 @@ assemble_udp_ip_header(unsigned char *buf, int *bufix, u_int32_t from, udp.uh_ulen = htons(sizeof(udp) + len); memset(&udp.uh_sum, 0, sizeof(udp.uh_sum)); - udp.uh_sum = wrapsum(checksum((unsigned char *)&udp, sizeof(udp), - checksum(data, len, checksum((unsigned char *)&ip.ip_src, + udp.uh_sum = wrapsum(checksum(data, len, checksum((unsigned char *)&udp, + sizeof(udp), checksum((unsigned char *)&ip.ip_src, 2 * sizeof(ip.ip_src), IPPROTO_UDP + (u_int32_t)ntohs(udp.uh_ulen))))); + if (udp.uh_sum == htons(0)) + udp.uh_sum = htons(0xffff); + memcpy(&buf[*bufix], &udp, sizeof(udp)); *bufix += sizeof(udp); } @@ -166,7 +169,7 @@ decode_udp_ip_header(unsigned char *buf, int bufix, struct sockaddr_in *from, struct ip *ip; struct udphdr *udp; u_int32_t ip_len = (buf[bufix] & 0xf) << 2; - u_int32_t sum, usum; + u_int32_t sum, usum, pseudo_sum; static int ip_packets_seen; static int ip_packets_bad_checksum; static int udp_packets_seen; @@ -224,23 +227,37 @@ decode_udp_ip_header(unsigned char *buf, int bufix, struct sockaddr_in *from, } usum = udp->uh_sum; - udp->uh_sum = 0; - - sum = wrapsum(checksum((unsigned char *)udp, sizeof(*udp), - checksum(data, len, checksum((unsigned char *)&ip->ip_src, - 2 * sizeof(ip->ip_src), - IPPROTO_UDP + (u_int32_t)ntohs(udp->uh_ulen))))); - udp_packets_seen++; - if (usum && usum != sum) { - udp_packets_bad_checksum++; - if (udp_packets_seen > 4 && udp_packets_bad_checksum != 0 && - (udp_packets_seen / udp_packets_bad_checksum) < 2) { - note("%d bad udp checksums in %d packets", - udp_packets_bad_checksum, udp_packets_seen); - udp_packets_seen = udp_packets_bad_checksum = 0; + + if (usum != htons(0)) { + udp->uh_sum = 0; + + pseudo_sum = checksum((unsigned char *)&ip->ip_src, + 2 * sizeof(ip->ip_src), + IPPROTO_UDP + (u_int32_t)ntohs(udp->uh_ulen)); + sum = wrapsum(checksum(data, len, + checksum((unsigned char *)udp, sizeof(*udp), pseudo_sum))); + if (sum == htons(0)) + sum = htons(0xffff); + + /* + * In addition to accepting UDP packets with the correct + * checksum in the checksum field, accept also the ones which + * have the correct pseudo header checksum in the checksum + * field. This allows to process UDP packets, which have been + * marked for transmit checksum offloading by the sender side. + */ + if (usum != sum && usum != htons(pseudo_sum & 0x0000ffff)) { + udp_packets_bad_checksum++; + if (udp_packets_seen > 4 && + udp_packets_bad_checksum != 0 && + (udp_packets_seen / udp_packets_bad_checksum) < 2) { + note("%d bad udp checksums in %d packets", + udp_packets_bad_checksum, udp_packets_seen); + udp_packets_seen = udp_packets_bad_checksum = 0; + } + return (-1); } - return (-1); } memcpy(&from->sin_port, &udp->uh_sport, sizeof(udp->uh_sport));