On Mon, May 4, 2020 at 9:12 AM Lorenz Bauer <lmb@xxxxxxxxxxxxxx> wrote: > > In our TC classifier cls_redirect [1], we use the following sequence > of helper calls to > decapsulate a GUE (basically IP + UDP + custom header) encapsulated packet: > > skb_adjust_room(skb, -encap_len, > BPF_ADJ_ROOM_MAC, BPF_F_ADJ_ROOM_FIXED_GSO) > bpf_redirect(skb->ifindex, BPF_F_INGRESS) > > It seems like some checksums of the inner headers are not validated in > this case. > For example, a TCP SYN packet with invalid TCP checksum is still accepted by the > network stack and elicits a SYN ACK. > > Is this known but undocumented behaviour or a bug? In either case, is > there a work > around I'm not aware of? I thought inner and outer csums are covered by different flags and driver suppose to set the right one depending on level of in-hw checking it did.
