Erroneous TCP checksum.

I am writing a NAT like module in the kernel which modifies the TCP
header in the sk_buff and recalculates the TCP checksum. This is done
in the NF_IP_LOCAL_OUT netfilter hook.

When the packet leaves the host, I can verify using tcpdump that the
checksum is correct. But when it reaches the destination the checksum
appears to have changed and is incorrect. I have walked through the
code many times but am completely stumped by the problem. I have added
a hook in NF_IP_POST_ROUTING for debugging the checksum and it prints
out the correctly recalculated checksum in the NF_IP_LOCAL_OUT hook. So
apparently somehow the checksum changes after it leaves the
NF_IP_POST_ROUTING hook (somewhere in the ethernet layer ??). Also, all
the header fields received at the other end are exactly the same but
the checksum.

With regards to the netfilter hook functions at what level does tcpdump
capture the packets ?

Any debugging suggestions/pointers will be a great help.

thanks,
Shavian.

(E-Mail Removed) wrote:
> I am writing a NAT like module in the kernel which modifies the TCP
> header in the sk_buff and recalculates the TCP checksum. This is done
> in the NF_IP_LOCAL_OUT netfilter hook.
>
> When the packet leaves the host, I can verify using tcpdump that the
> checksum is correct. But when it reaches the destination the checksum
> appears to have changed and is incorrect. I have walked through the
> code many times but am completely stumped by the problem. I have added
> a hook in NF_IP_POST_ROUTING for debugging the checksum and it prints
> out the correctly recalculated checksum in the NF_IP_LOCAL_OUT hook. So
> apparently somehow the checksum changes after it leaves the
> NF_IP_POST_ROUTING hook (somewhere in the ethernet layer ??). Also, all
> the header fields received at the other end are exactly the same but
> the checksum.
>
> With regards to the netfilter hook functions at what level does tcpdump
> capture the packets ?
>
> Any debugging suggestions/pointers will be a great help.
>
> thanks,
> Shavian.
>

Check if your network card has hardware-assisted checksum
calculation. It could produce a different checksum on the
line than what is seen by tcpdump at the source host.

--

Tauno Voipio
tauno voipio (at) iki fi

(E-Mail Removed) wrote:
> When the packet leaves the host, I can verify using tcpdump that the
> checksum is correct.

A somewhat pedantic question, but are you _actually_ looking at the
packet on the wire, or are you simply running tcpdump on the sending
host?

Tcpdump on the sending host will almost certainly see the packet
before it goes through the NIC, which as someone else points-out may
be doing CKO (ChecKsum Offload) which has particular requirements for
what the TCP header should look like when passed to the NIC.

(And I see now looking further down in your post you were thinking
about the tcpdump issue)

rick jones
--
a wide gulf separates "what if" from "if only"
these opinions are mine, all mine; HP might not want them anyway...
feel free to post, OR email to raj in cup.hp.com but NOT BOTH...

I checked the NIC , its not doing checksum offloading. Another thing I
discovered is that the sk_buff.cloned() function returns true for these
skbs, so I thought maybe I should make a private copy of the skbuffs
and then pass them downstream. I tried something like (inside the
NF_IP_LOCAL_OUT hook):

if (skb_shared(skb) || skb_cloned(skb)) {

struct sk_buff *nskb;


nskb = skb_copy(skb, GFP_ATOMIC);

if (nskb == NULL) {

return 0
}

if (skb->sk)

skb_set_owner_w(nskb, skb->sk);

kfree_skb(skb);

skb = nskb;

}

But this crashes the system.

What are the intricacies I need to take care of when copying a skb and
releasing the old one? Any url/book/doc/sample code which will be
useful here ?

thanks
Shavian.