Eli Britstein <[email protected]> writes:
> IP reassembly must not accept data past an MF=0 fragment. Track
> last fragments, reject ranges beyond them on insert, and require the
> sorted rightmost fragment to be MF=0 before completing a list.
>
> The accompanying test is added to tests/ofproto-dpif.at (using
> netdev-dummy/receive with variable-built packets and precomputed IPv4
> header checksums) rather than the system-traffic suite.
>
> Assisted-by: composer-2.5-fast, Cursor
> Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation handling.")
> Signed-off-by: Eli Britstein <[email protected]>
> ---
> lib/ipf.c | 36 +++++++++++++++++++--
> tests/ofproto-dpif.at | 74 +++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 108 insertions(+), 2 deletions(-)
[...]
> @@ -872,14 +901,17 @@ ipf_process_frag(struct ipf *ipf, struct ipf_list
> *ipf_list,
> {
> bool duped_frag = ipf_is_frag_duped(ipf_list->frag_list,
> ipf_list->last_inuse_idx, start_data_byte, end_data_byte);
> + bool beyond_last = ipf_is_beyond_last_frag(ipf_list->frag_list,
> + ipf_list->last_inuse_idx, start_data_byte, end_data_byte, lf);
> int last_inuse_idx = ipf_list->last_inuse_idx;
>
> - if (!duped_frag) {
> + if (!duped_frag && !beyond_last) {
> if (last_inuse_idx < ipf_list->size - 1) {
> struct ipf_frag *frag = &ipf_list->frag_list[last_inuse_idx + 1];
> frag->pkt = pkt;
> frag->start_data_byte = start_data_byte;
> frag->end_data_byte = end_data_byte;
> + frag->last_frag = lf;
> ipf_list->last_inuse_idx++;
> atomic_count_inc(&ipf->nfrag);
> ipf_count(ipf, v6, IPF_NFRAGS_ACCEPTED);
IIUC, we now count IPF_NFRAGS_OVERLAP on frags that are overlapping, and
frags that are beyond the last frag. Might be better to introduce a
counter for this (given you're introducing a counter already in this
series for 'too large').
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
