From 159fc543658e9dbfe50f00f92e1a16c55cd06beb Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Sat, 27 Oct 2018 02:38:51 +0200 Subject: receive: assume all levels have been checksumed, not just outer This means we do less computation on encapsulated payloads. --- src/receive.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/receive.c') diff --git a/src/receive.c b/src/receive.c index d5bce92..81140e9 100644 --- a/src/receive.c +++ b/src/receive.c @@ -379,7 +379,14 @@ static void wg_packet_consume_data_done(struct wg_peer *peer, goto dishonest_packet_type; skb->dev = dev; + /* We've already verified the Poly1305 auth tag, which means this packet + * was not modified in transit. We can therefore tell the networking + * stack that all checksums of every layer of encapsulation have already + * been checked "by the hardware" and therefore is unneccessary to check + * again in software. + */ skb->ip_summed = CHECKSUM_UNNECESSARY; + skb->csum_level = ~0; /* All levels */ skb->protocol = wg_skb_examine_untrusted_ip_hdr(skb); if (skb->protocol == htons(ETH_P_IP)) { len = ntohs(ip_hdr(skb)->tot_len); -- cgit v1.2.3-59-g8ed1b