Missmatch between recalculated and received UDP checksum

[jrr-xena]

Brief description

Problems with Scapy providing a different value for the UDP checksum (when recalculated) than what is received

I'm using a VXLAN packet (see attached code snippet) that uses IPv6. To calculate the UDP checksum, scapy calculates an IPv6 pseudo header, but seems it is using the wrong UDP packet length (rfc2460 section-8.1). Scapy gives:

ph6.src = ::
ph6.dst = ::
ph6.uplen = 43
ph6.zero = 0
ph6.nh = 17

The correct length should be 270 but scapy is only using the udp_hdr_len (8B), vxlan_hdr_len (8B), inner_ether_src (6B), inner_ether_dst (6B), inner_ether_len (2B), LLC_hdr_len (4B), the following 9B after LLC HDR and ignoring all the rest of the payload.

Wireshark does compute the expected (0x1a8) UDP checksum when parsing this packet. This packet is generated using a test equipment and captured inside the same test equipment, so there is no offload going on.

Using scapy 2.7.0 and python 3.11.2

Scapy version

2.7.0

Python version

3.11.2

Operating system

Lubuntu 20.04

Additional environment information

No response

How to reproduce

import binascii

from scapy.all import *
from scapy.layers.l2 import Ether
from scapy.layers.inet import UDP

pkt_data = "ffffffffffffffffffffffff8100000086dd60000000010e1100000000000000000000000000000000000000000000000000000000000000000018bd2118010e01a8738a32362d5473c879f89f16a8f9cd673fec8d6b000d9a2976054be71268024a7817f64d63fad1d4eb2db918f004c198dc03e7ec4e836ca554e1b4f0c157c61728ae722bd55eac05d698f04a0df32b8d21f031ae70a7ad530d027915763af0e736fa6d61a334289b3aef64855b44ed09f02de48485a3337575d409561fe192bca02214a8a5b10cc66c756992eadaeaf56f8eeeb58c18cce9f36fd8983ff7890dedc28ed254080c180231440188d5afc32bff2193a8f94a1b683b1e850a613eaf42ccd37e5af706d93b11e31649a1b9f39c613ce5a4263fcfe7873da6fdd9d09c90f15b687efc3342189cbac70ab686d1dc5f000015128c4d3400080000034584f14d8e217811d6cee444"

data_bytes = binascii.unhexlify(pkt_data)
p0 = Ether(data_bytes)

print('--'*20)
print("checksum (received): ", hex(p0[UDP].chksum))

del p0[UDP].chksum
p0 = p0.__class__(bytes(p0))

print("checksum (scapy)   : ", hex(p0[UDP].chksum))

Actual result

---------------------------------------- 
checksum (received):  0x1a8 
checksum (scapy)   :  0x424d

Expected result

---------------------------------------- 
checksum (received):  0x1a8 
checksum (scapy)   :  0x424d

expected checksum calculated by scapy: 0x1a8 

Related resources

No response

[p-l-]

I'm not sure the packet is correct or if something went wrong in the capture (Ethernet source address is broadcast, weird padding layers) but that's a confirmed bug in Scapy.

TL;DR: we have two Padding layers, one of which is data for the UDP layer, hence should be used when computing the checksum, but is not. I don't have for now a clear idea on how we could fix that simply.

The reason is that we have an Ethernet over VXLAN over another Ethernet layer (Ether() / Dot1Q() / IPv6() / UDP() / Dot3() / LLC() / data) and both Ethernet layers (first Ether() and then Dot3() / LLC() have their own Padding layer.

The packet is as follows:

###[ Ethernet ]###
  dst       = ff:ff:ff:ff:ff:ff
  src       = ff:ff:ff:ff:ff:ff
  type      = n_802_1Q
###[ 802.1Q ]###
     prio      = 0
     dei       = 0
     vlan      = 0
     type      = IPv6
###[ IPv6 ]###
        version   = 6
        tc        = 0
        fl        = 0
        plen      = 270
        nh        = UDP
        hlim      = 0
        src       = ::
        dst       = ::
###[ UDP ]###
           sport     = 6333
           dport     = otv
           len       = 270
           chksum    = 0x1a8
###[ VXLAN ]###
              flags     = OAM+R+V1+V2+R
              reserved1 = 9056822
              vni       = 0x2d5473
              reserved2 = 0xc8
###[ 802.3 ]###
                 dst       = 79:f8:9f:16:a8:f9
                 src       = cd:67:3f:ec:8d:6b
                 len       = 13
###[ LLC ]###
                    dsap      = 0x9a
                    ssap      = 0x29
                    ctrl      = 118
###[ Raw ]###
                       load      = b'\x05K\xe7\x12h\x02Jx\x17\xf6'
###[ Padding ]###
                          load      = b'Mc\xfa\xd1\xd4\xeb-\xb9\x18\xf0\x04\xc1\x98\xdc\x03\xe7\xecN\x83l\xa5T\xe1\xb4\xf0\xc1W\xc6\x17(\xaer+\xd5^\xac\x05\xd6\x98\xf0J\r\xf3+\x8d!\xf01\xaep\xa7\xadS\r\x02y\x15v:\xf0\xe76\xfama\xa34(\x9b:\xefd\x85[D\xed\t\xf0-\xe4\x84\x85\xa33uu\xd4\tV\x1f\xe1\x92\xbc\xa0"\x14\xa8\xa5\xb1\x0c\xc6lui\x92\xea\xda\xea\xf5o\x8e\xee\xb5\x8c\x18\xcc\xe9\xf3o\xd8\x98?\xf7\x89\r\xed\xc2\x8e\xd2T\x08\x0c\x18\x021D\x01\x88\xd5\xaf\xc3+\xff!\x93\xa8\xf9J\x1bh;\x1e\x85\na>\xafB\xcc\xd3~Z\xf7\x06\xd9;\x11\xe3\x16I\xa1\xb9\xf3\x9ca<\xe5\xa4&?\xcf\xe7\x87=\xa6\xfd\xd9\xd0\x9c\x90\xf1[h~\xfc3B\x18\x9c\xba\xc7\n\xb6\x86\xd1\xdc_\x00\x00\x15\x12\x8cM4\x00\x08\x00\x00\x03E\x84\xf1M\x8e!x\x11'
###[ Padding ]###
                             load      = b'\xd6\xce\xe4D'

For Scapy when we compute the checksums, we do not include Padding layers. But for the UDP() layer in this packet, the first Padding layer is not actual padding, it's data (it's padding for the Dot3() layer) and should be included to compute the checksum value.

To check that, let's replace the inner Padding using Raw so that it is used in the checksum:

pkt_data = bytes.fromhex("ffffffffffffffffffffffff8100000086dd60000000010e1100000000000000000000000000000000000000000000000000000000000000000018bd2118010e01a8738a32362d5473c879f89f16a8f9cd673fec8d6b000d9a2976054be71268024a7817f64d63fad1d4eb2db918f004c198dc03e7ec4e836ca554e1b4f0c157c61728ae722bd55eac05d698f04a0df32b8d21f031ae70a7ad530d027915763af0e736fa6d61a334289b3aef64855b44ed09f02de48485a3337575d409561fe192bca02214a8a5b10cc66c756992eadaeaf56f8eeeb58c18cce9f36fd8983ff7890dedc28ed254080c180231440188d5afc32bff2193a8f94a1b683b1e850a613eaf42ccd37e5af706d93b11e31649a1b9f39c613ce5a4263fcfe7873da6fdd9d09c90f15b687efc3342189cbac70ab686d1dc5f000015128c4d3400080000034584f14d8e217811d6cee444")
pkt = Ether(pkt_data)

padding = pkt[Padding].payload
padding_inside = pkt[Padding].load
pkt[Raw].remove_payload()
pkt /= Raw(padding_inside)
pkt /= padding
del pkt[UDP].chksum

Now, pkt.show2() shows the correct value:

###[ Ethernet ]###
  dst       = ff:ff:ff:ff:ff:ff
  src       = ff:ff:ff:ff:ff:ff
  type      = n_802_1Q
###[ 802.1Q ]###
     prio      = 0
     dei       = 0
     vlan      = 0
     type      = IPv6
###[ IPv6 ]###
        version   = 6
        tc        = 0
        fl        = 0
        plen      = 270
        nh        = UDP
        hlim      = 0
        src       = ::
        dst       = ::
###[ UDP ]###
           sport     = 6333
           dport     = otv
           len       = 270
           chksum    = 0x1a8
[...]

I don't see a quick fix for that unfortunately :-/

[jrr-xena]

Ok, thanks for the quick answer. And yes, the packet may look incorrect because the UDP payload and src/dst ports are randomized by a traffic generator, so I guess with millions of packets flowing eventually a packet with some sort of structure will appear.

But I can use your suggested code of replacing anything beyond UDP with Raw payload as a workaround.

[p-l-]

Yeah for specific use cases it might help, but that is not a viable solution for the bug!