wgengine/netstack: accept IPv4 fragments before reassembly

The netstack GRO receive path validates L4 checksums before marking
packets as RX checksum validated for gVisor. That validation is invalid
for IPv4 fragments because TCP and UDP checksums cover the complete
reassembled transport packet, not an individual fragment.

Keep validating the IPv4 header checksum, but let IPv4 fragments through
to gVisor for reassembly without pre-validating TCP or UDP.

Fixes #20320

Change-Id: I779363a5e0ac5abee6a8e2a2a44b418fbc5f5e27
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

wgengine/netstack/gro/gro_test.go

@@ -62,6 +62,23 @@ func Test_RXChecksumOffload(t *testing.T) {
 	at := 20 + 16
 	tcp4InvalidCsum[at] = ^tcp4InvalidCsum[at]
 
+	tcp4FirstFragment := make([]byte, 20+20+60)
+	copy(tcp4FirstFragment, tcp4[:len(tcp4FirstFragment)])
+	ipv4H = header.IPv4(tcp4FirstFragment)
+	ipv4H.SetTotalLength(uint16(len(tcp4FirstFragment)))
+	ipv4H.SetFlagsFragmentOffset(header.IPv4FlagMoreFragments, 0)
+	ipv4H.SetChecksum(0)
+	ipv4H.SetChecksum(^ipv4H.CalculateChecksum())
+
+	tcp4SecondFragment := make([]byte, 20+40)
+	copy(tcp4SecondFragment, tcp4[:20])
+	copy(tcp4SecondFragment[20:], tcp4[20+80:])
+	ipv4H = header.IPv4(tcp4SecondFragment)
+	ipv4H.SetTotalLength(uint16(len(tcp4SecondFragment)))
+	ipv4H.SetFlagsFragmentOffset(0, 80)
+	ipv4H.SetChecksum(0)
+	ipv4H.SetChecksum(^ipv4H.CalculateChecksum())
+
 	tcp6ExtHeaderInvalidCsum := make([]byte, len(tcp6ExtHeader))
 	copy(tcp6ExtHeaderInvalidCsum, tcp6ExtHeader)
 	at = 40 + 8 + 16
@@ -87,6 +104,16 @@ func Test_RXChecksumOffload(t *testing.T) {
 			tcp4InvalidCsum,
 			false,
 		},
+		{
+			"tcp4 first fragment skips L4 csum",
+			tcp4FirstFragment,
+			true,
+		},
+		{
+			"tcp4 second fragment skips L4 csum",
+			tcp4SecondFragment,
+			true,
+		},
 		{
 			"tcp6 with ext header invalid csum",
 			tcp6ExtHeaderInvalidCsum,