Add a coverage counter when userspace conntrack receives a packet
with invalid l4 checksum. When using veth for testing, users
often forget to turn off the tx offload on the other side of the
namespace, causing l4 checksum not calculated in packet header,
and at conntrack, return invalid conntrack state.
Suggested-by: Yi-Hung Wei <yihung....@gmail.com>
Signed-off-by: William Tu <u9012...@gmail.com>
---
v2: add also icmp csum error
---
lib/conntrack.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/lib/conntrack.c b/lib/conntrack.c
index 0cbc8f6d2b25..95d48c5eecae 100644
--- a/lib/conntrack.c
+++ b/lib/conntrack.c
@@ -44,6 +44,7 @@ VLOG_DEFINE_THIS_MODULE(conntrack);
COVERAGE_DEFINE(conntrack_full);
COVERAGE_DEFINE(conntrack_long_cleanup);
+COVERAGE_DEFINE(conntrack_l4csum_err);
struct conn_lookup_ctx {
struct conn_key key;
@@ -1661,6 +1662,7 @@ checksum_valid(const struct conn_key *key, const void
*data, size_t size,
} else if (key->dl_type == htons(ETH_TYPE_IPV6)) {
return packet_csum_upperlayer6(l3, data, key->nw_proto, size) == 0;
} else {
+ COVERAGE_INC(conntrack_l4csum_err);
return false;
}
}
@@ -1704,7 +1706,12 @@ check_l4_udp(const struct conn_key *key, const void
*data, size_t size,
static inline bool
check_l4_icmp(const void *data, size_t size, bool validate_checksum)
{
- return validate_checksum ? csum(data, size) == 0 : true;
+ if (validate_checksum && csum(data, size) != 0) {
+ COVERAGE_INC(conntrack_l4csum_err);
+ return false;
+ } else {
+ return true;
+ }
}
static inline bool
--
2.7.4
_______________________________________________
dev mailing list
d...@openvswitch.org
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
