TCP, UDP: Calculate partial (pseudo header) checksums for offload

Linux and Windows, at least, when performing Local Checksum Offload
during Generic Segmentation Offload and at other times, place the one's
complement sum of the pseudo header in the checksum field, which
provides the necessary correction when a device (or its driver,
if not supported in hardware) computes the one's complement checksum
of each inner layer buffer in the skbuff. (This is why GSO requires
equal length buffers - so that the pseudo header contribution to
the checksum is the same.)

When performing our Internet checksum calculation, we can output
the partial sum of all but the last vector, which is an intermediate
result we calculate in the process anyway. The last vector is
generally the payload, and the previous vectors are for the pseudo
header. We can then compare this partial sum to the value in the
UDP or TCP header if the overall computed checksum isn't 0.
If it matches appropriately, we can have a more informative and
less scary message.

Update the tests a bit because this causes checksums to no longer
fail and be reported malformed in the http2 reassembly example.

Fix #18864. Related to #19109

1 files changed, 13 insertions, 12 deletions

diff --git a/test/suite_clopts.py b/test/suite_clopts.py
index d13f96cc86..86aca99eac 100644
--- a/test/suite_clopts.py
+++ b/test/suite_clopts.py
@@ -226,7 +226,7 @@ class TestTsharkZExpert:
     def test_tshark_z_expert_all(self, cmd_tshark, capture_file, test_env):
         proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert',
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
         # http2-data-reassembly.pcap has Errors, Warnings, Notes, and Chats
         # when TCP checksum are verified.
         assert grep_output(proc.stdout, 'Errors')
@@ -237,7 +237,7 @@ class TestTsharkZExpert:
     def test_tshark_z_expert_error(self, cmd_tshark, capture_file, test_env):
         proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,error',
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
         assert grep_output(proc.stdout, 'Errors')
         assert not grep_output(proc.stdout, 'Warns')
         assert not grep_output(proc.stdout, 'Notes')
@@ -246,7 +246,7 @@ class TestTsharkZExpert:
     def test_tshark_z_expert_warn(self, cmd_tshark, capture_file, test_env):
         proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,warn',
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
         assert grep_output(proc.stdout, 'Errors')
         assert grep_output(proc.stdout, 'Warns')
         assert not grep_output(proc.stdout, 'Notes')
@@ -255,7 +255,7 @@ class TestTsharkZExpert:
     def test_tshark_z_expert_note(self, cmd_tshark, capture_file, test_env):
         proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,note',
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
         assert grep_output(proc.stdout, 'Errors')
         assert grep_output(proc.stdout, 'Warns')
         assert grep_output(proc.stdout, 'Notes')
@@ -264,7 +264,7 @@ class TestTsharkZExpert:
     def test_tshark_z_expert_chat(self, cmd_tshark, capture_file, test_env):
         proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,chat',
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
         assert grep_output(proc.stdout, 'Errors')
         assert grep_output(proc.stdout, 'Warns')
         assert grep_output(proc.stdout, 'Notes')
@@ -293,7 +293,7 @@ class TestTsharkZExpert:
     def test_tshark_z_expert_filter(self, cmd_tshark, capture_file, test_env):
         proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,udp',
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
         # Filtering for UDP should produce no expert infos.
         assert not grep_output(proc.stdout, 'Errors')
         assert not grep_output(proc.stdout, 'Warns')
@@ -301,14 +301,15 @@ class TestTsharkZExpert:
         assert not grep_output(proc.stdout, 'Chats')
 
     def test_tshark_z_expert_error_filter(self, cmd_tshark, capture_file, test_env):
-        proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,warn,tls',  # tls is a filter
+        proc = subprocesstest.run((cmd_tshark, '-q', '-z', 'expert,note,http',  # tls is a filter
             '-o', 'tcp.check_checksum:TRUE',
-            '-r', capture_file('http2-data-reassembly.pcap')), capture_output=True, env=test_env)
-        # Filtering for TLS should produce only Error level expert infos
-        # with checksumming turned on, because the lower level expert infos
-        # are on the packets with TCP but not TLS.
+            '-r', capture_file('http-ooo-fuzzed.pcapng')), capture_output=True, env=test_env)
+        # Filtering for HTTP and Note level expert info should produce only
+        # Error and Warning level expert infos with checksumming turned on.
+        # The Note warnings on are packets with TCP but not HTTP, and we're
+        # filtering out the Chat level.
         assert grep_output(proc.stdout, 'Errors')
-        assert not grep_output(proc.stdout, 'Warns')
+        assert grep_output(proc.stdout, 'Warns')
         assert not grep_output(proc.stdout, 'Notes')
         assert not grep_output(proc.stdout, 'Chats')