Page MenuHomeVyOS Platform

ISC DHCP incorrect UDP checksum generation
Needs testing, NormalPublicBUG

Description

Debian Bug 353161 (reported fixed in isc-dhcp 4.3.2-1) May 2015

Current package vyatta-dhcp3-relay 4.1.8+vyos1+helium2 (DHCPd also affected)

Produces the following log messages (level info):

Jan 2 12:28:45 10.10.64.3 dhcrelay: 4 bad udp checksums in 6 packets
Jan 2 12:28:51 10.10.64.3 dhcrelay: 4 bad udp checksums in 5 packets
Jan 2 12:28:53 10.10.64.3 dhcrelay: 4 bad udp checksums in 5 packets
Jan 2 12:28:55 10.10.64.3 dhcrelay: 4 bad udp checksums in 6 packets
Jan 2 12:28:56 10.10.64.3 dhcrelay: 4 bad udp checksums in 5 packets
Jan 2 12:28:58 10.10.64.3 dhcrelay: 4 bad udp checksums in 5 packets
Jan 2 12:29:03 10.10.64.3 dhcrelay: 4 bad udp checksums in 6 packets
Jan 2 12:29:03 10.10.64.3 dhcrelay: 4 bad udp checksums in 5 packets
Jan 2 12:29:10 10.10.64.3 dhcrelay: 4 bad udp checksums in 5 packets
Jan 2 12:29:21 10.10.64.3 dhcrelay: 4 bad udp checksums in 6 packets

Not sure how difficult building a post- 4.3.2-1 package will be on Squeeze.

Details

Difficulty level
Hard (possibly days)
Version
1.1.8
Why the issue appeared?
Will be filled on close

Event Timeline

rps created this task.Jan 2 2018, 12:50 PM
syncer triaged this task as Normal priority.Jan 6 2018, 11:13 PM

Is it reproducible in latest 1.2.0?

rps added a comment.Sep 26 2018, 1:51 PM

1.2 rolling has ISC dhcrelay 4.3.1 from the Debian isc-dhcp-relay 4.3.1-6+deb8u3 package.

The upstream fixes for handling DHCP on 802.1q interfaces and correct UDP checksum generation were only introduced in ISC 4.3.2-1, and looking at Debian maintainer patches that are part of this package I see no reference to a checksum fix so my guess is that it's still an issue.

I will try to do a test ...

pasik added a subscriber: pasik.Nov 4 2018, 11:24 AM
syncer changed the task status from Open to Needs testing.Feb 7 2019, 11:58 PM
syncer assigned this task to rps.
jdevincentis added a subscriber: jdevincentis.EditedSep 6 2019, 9:08 AM

I can confirm this is still a problem in current rolling versions.

I'm currently researching a workaround - It does look like using iptables to recalculate the checksum for incoming DHCP packets may be the way to resolve this until 1.3 comes out.

tjh added a subscriber: tjh.Apr 15 2020, 2:32 AM

I'm seeing this in Vyos 1.2.5 just released:

Apr 15 14:00:46 ferrari dhcpd[6148]: 59 bad udp checksums in 117 packets
Apr 15 14:01:44 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:03:14 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:04:06 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:04:56 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:06:25 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:07:34 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:08:53 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:09:51 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:11:15 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:12:34 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:13:20 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:14:33 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:15:46 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:17:07 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:18:15 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:19:37 ferrari dhcpd[6148]: 5 bad udp checksums in 6 packets
Apr 15 14:20:35 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:21:51 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:23:02 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:24:07 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:25:05 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:26:25 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:27:38 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:28:48 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:29:48 ferrari dhcpd[6148]: 5 bad udp checksums in 6 packets

@jdevincentis Are you able to provide more details about the iptables fix you mention?

jjakob added a subscriber: jjakob.Apr 15 2020, 7:16 AM

My first thought would be something wrong with offloading on the NIC -
there was a change recently that turns all the offloading settings on by
default, you can disable some in the ethernet config. My suggestion to
leave the default disabled and enable it on demand wasn't taken into
account.

Apr 15, 2020 4:32:28 AM tjh (Tim Harman) <phabricator@mg.vyos.io>:

tjh added a comment.

I'm seeing this in Vyos 1.2.5 just released:

Apr 15 14:00:46 ferrari dhcpd[6148]: 59 bad udp checksums in 117

packets

Apr 15 14:01:44 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:03:14 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:04:06 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:04:56 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:06:25 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:07:34 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:08:53 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:09:51 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:11:15 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:12:34 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:13:20 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:14:33 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:15:46 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:17:07 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:18:15 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:19:37 ferrari dhcpd[6148]: 5 bad udp checksums in 6 packets
Apr 15 14:20:35 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:21:51 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:23:02 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:24:07 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:25:05 ferrari dhcpd[6148]: 4 bad udp checksums in 5 packets
Apr 15 14:26:25 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:27:38 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:28:48 ferrari dhcpd[6148]: 5 bad udp checksums in 5 packets
Apr 15 14:29:48 ferrari dhcpd[6148]: 5 bad udp checksums in 6 packets

@jdevincentis Are you able to provide more details about the iptables

fix you mention?

TASK DETAIL
https://phabricator.vyos.net/T508

EMAIL PREFERENCES
https://phabricator.vyos.net/settings/panel/emailpreferences/

To: rps, tjh
Cc: tjh, jdevincentis, pasik, dmbaturin, Active contributors,

Maintainers, rps, teadur, jack9603301, hard, pa4ka, jestabro, Alfa80,
dongjunbo, hexes

As noted earlier in the ticket, this is a problem with the version of ISC DHCPD that VyOS 1.2.x is shipping. It's a very old version.

In T508#20039, @rps wrote:

1.2 rolling has ISC dhcrelay 4.3.1 from the Debian isc-dhcp-relay 4.3.1-6+deb8u3 package.

The upstream fixes for handling DHCP on 802.1q interfaces and correct UDP checksum generation were only introduced in ISC 4.3.2-1, and looking at Debian maintainer patches that are part of this package I see no reference to a checksum fix so my guess is that it's still an issue.

I will try to do a test ...

Ah, I missed that it's for 1.2, 1.3 has a newer isc-dhcp.