From: Stephen Hemminger <shemminger@linux-foundation•org>
To: bugzilla-daemon@bugzilla•kernel.org, vishal.swarnkar@gmail•com
Cc: netdev@vger•kernel.org
Subject: Re: [Bug 15703] New: Getting "MD5 Hash failed for" for fragmented IP packets.
Date: Wed, 7 Apr 2010 09:28:22 -0700 [thread overview]
Message-ID: <20100407092822.39f6ea2a@nehalam> (raw)
In-Reply-To: <bug-15703-100@https.bugzilla.kernel.org/>
On Tue, 6 Apr 2010 09:52:46 GMT
bugzilla-daemon@bugzilla•kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=15703
>
> Summary: Getting "MD5 Hash failed for" for fragmented IP
> packets.
> Product: Networking
> Version: 2.5
> Kernel Version: 2.6.31-14-generic
> Platform: All
> OS/Version: Linux
> Tree: Mainline
> Status: NEW
> Severity: normal
> Priority: P1
> Component: IPV4
> AssignedTo: shemminger@linux-foundation•org
> ReportedBy: vishal.swarnkar@gmail•com
> CC: vishal.swarnkar@gmail•com
> Regression: No
>
>
> I am using Ubuntu 9.10 with a kernel 2.6.31-14-generic.
>
> At my linux box I am receiving IP packets with TCP as payload with TCP-MD5
> option as its a BGP update.
>
> If I am getting fragmented IP packets on my Linux box then I am receiving only
> one fragment of the IP packet and I don't receive the second fragments because
> of some settings at my firewall ( I discard small packets, and the second
> fragment has only 20 bytes of data, so I consider it as small packet and always
> discard it).
>
> I have ensured that I am not receiving the second fragment of the packet all
> the time ( in all further retransmission ) using sniffers.
>
> Now for a IP fragmented packet I keep on getting messages
> "MD5 hash failed for IP(src)--> IP(Dst)". I receive this message for all
> fragmented packets. The message is in tcp_ipv4.c - >tcp_v4_inbound_md5_hash
> method.
>
> I hope I should not be getting these message because the fragmented packets
> should not be pushed to the upper layer( TCP) for further sanity checks(
> MD5-check sum verification), until all fragments are assembled together.
>
> I tried to look at the ip_rcv code and found that ip_local_deliver(struct
> sk_buff* skb) is calling ip_defrag() function to check if the fragmentation
> task is still in progress or not.
>
> I tried to dig down more into ip_defrag function and the return values from
> ip_defrag function and I hope that the check in the ip_local_deliver function
> is not correct.
>
> int ip_local_deliver(struct sk_buff *skb)
> {
> /*
> * Reassemble IP fragments.
> */
>
> if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
> if (ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER))
> return 0;
> }
>
> return NF_HOOK(PF_INET, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
> ip_local_deliver_finish);
> }
>
>
> I think the check for ip_defrag should be like this
> ------>>>>if (ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER) < 0)
>
> we should check the negative return to avoid ip_local_deliver_finish, instead
> of checking the null return.
Maybe path MTU discovery can help with this.
parent reply other threads:[~2010-04-07 16:29 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <bug-15703-100@https.bugzilla.kernel.org/>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20100407092822.39f6ea2a@nehalam \
--to=shemminger@linux-foundation$(echo .)org \
--cc=bugzilla-daemon@bugzilla$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=vishal.swarnkar@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox