openconfig / kne / 36185182373

47%

main: 47%

Build Type

Pull #774

github

Committed by kraney

Commit Message

Packet bridge captures packets with incorrect checksums

This is due to hardware offloads - packets do not have correct checksums
with the expectation the hardware will fill it in.

(Note this problem is already solved within meshnet; following that
example.)

1. Disable Hardware Offloads via ethtool:
   When NewSocketHandler opens an interface, it uses github.com/safchain/ethtool
   (matching meshnet's approach) to disable active TX checksum and segmentation
   offloads as well as RX GRO/LRO/checksum offloads so the Linux kernel veth
   driver does not coalesce incoming segments or leave local frames with
   partial checksums.

2. Finalize Partial Checksums via PACKET_AUXDATA:
   Enabled PACKET_AUXDATA on the raw AF_PACKET socket and updated ReadPacket to
   inspect TP_STATUS_CSUMNOTREADY (skb->ip_summed == CHECKSUM_PARTIAL). If a
   frame arrives from a peer veth in another container namespace where TX
   checksum offload was still enabled, finalizePartialChecksum computes the
   missing L4 (TCP/UDP/ICMPv6) checksum in software before forwarding.

3. Unit Tests:
   Added unit tests covering offload disabling, PACKET_AUXDATA parsing, and
   IPv4/IPv6/VLAN partial checksum finalization.

Pull Request Pull Request #774: Packet bridge captures packets with incorrect checksums

Coverage Stats

124 of 161 new or added lines in 1 file covered. (77.02%)

2 existing lines in 1 file now uncovered.

6961 of 14627 relevant lines covered (47.59%)

0.54 hits per line