[PATCH net 0/6] seg6: fix skb checksum updates with CHECKSUM_COMPLETE

[Andrea Mayer]

This series fixes the skb->csum updates with CHECKSUM_COMPLETE when the
SRv6 code processes a received packet. In several places skb->csum is not
updated correctly:
 - ipv6_srh_rcv() updates skb->csum with the wrong sign for the new
   Segments Left and destination address, and not at all for the Hop Limit
   decrement.
 - advance_nextseg() and seg6_next_csid_advance_arg() in seg6_local do
   not update skb->csum.
 - The End.BPF program and seg6_bpf_has_valid_srh() can change the
   packet without updating skb->csum.
 - In L2ENCAP and L2ENCAP_RED mode, the MAC header put back in front of
   the frame is not added to skb->csum.

When the packet is then delivered on the same node, the effect depends on
who computed skb->csum. With skb->csum computed in software, for example by
conntrack, UDP can drop the packet as a checksum error. With skb->csum
computed by the device, TCP can log a "hw csum failure", as if the device
had computed a wrong skb->csum. In the L2ENCAP case skb->csum can be read
on local delivery, for example by a raw socket with IPV6_CHECKSUM.

The series is organized as follows:
 - Patch 1/6 fixes the update_csum_diff4() and update_csum_diff16()
   helpers.
 - Patch 2/6 updates skb->csum for the Hop Limit decrement in
   ipv6_srh_rcv().
   It depends on patch 1/6.
 - Patch 3/6 updates skb->csum when SRv6 behaviors advance to the next SID.
   It depends on patch 1/6.
 - Patch 4/6 discards CHECKSUM_COMPLETE after the End.BPF program.
 - Patch 5/6 accounts for the MAC header in skb->csum on L2 encapsulation.
 - Patch 6/6 adds a selftest that uses a tc ct action to compute skb->csum.
   It covers the paths of patches 1/6 to 4/6, and a control datagram
   checks that the test detects a wrong skb->csum.

Tested with the srv6_*.sh selftests, including the new one, and with the
lwt_seg6local BPF selftest. The series was also tested with a ConnectX-6 Lx
NIC (mlx5) that provides CHECKSUM_COMPLETE. Without the series, TCP over
the SRv6 paths of patches 1/6 to 4/6 can log "hw csum failure". The same
happens for a raw socket with IPV6_CHECKSUM, on a packet delivered locally
after L2ENCAP. With this series, none of this happens.

Thanks,
Andrea

Andrea Mayer (6):
  seg6: fix skb checksum update helpers
  seg6: update skb checksum when ipv6_srh_rcv() decrements the Hop Limit
  seg6: update skb checksum when SRv6 behaviors advance to the next SID
  seg6: discard CHECKSUM_COMPLETE after the End.BPF program
  seg6: account for the MAC header in skb checksum on L2 encapsulation
  selftests: seg6: add test for skb checksum with CHECKSUM_COMPLETE

 include/net/seg6.h                            |   4 +-
 net/ipv6/exthdrs.c                            |   8 +
 net/ipv6/seg6_iptunnel.c                      |   2 +-
 net/ipv6/seg6_local.c                         |  24 +-
 tools/testing/selftests/net/Makefile          |   1 +
 .../selftests/net/srv6_csum_complete.bpf.c    |  65 ++
 .../selftests/net/srv6_csum_complete_test.sh  | 642 ++++++++++++++++++
 7 files changed, 742 insertions(+), 4 deletions(-)
 create mode 100644 tools/testing/selftests/net/srv6_csum_complete.bpf.c
 create mode 100755 tools/testing/selftests/net/srv6_csum_complete_test.sh

-- 
2.43.0