On 10/16/26 4:01 PM, [email protected] wrote: > Hello, > > This series fixes header length checks in the userspace datapath. > Version 1 went to the security team, who asked for it to be posted here > for review as one series. > > Patches 1 to 10 are minimal fixes, one per bug, each with a test: > > 1 the ND option walk in packet_set_nd() and odp_set_nd() > 2 the SCTP chunk header length check in conntrack > 3 conntrack ICMP handlers picked by protocol number alone > 4 the TCP and SCTP checksum update on a truncated quoted header > 5-7 the GTP-U, ERSPAN and GRE tunnel pops > 8 NSH set and pop > 9 layer offsets and checksum offloads left by output truncation > 10 set_arp() on a truncated ARP header > > With AddressSanitizer, the test of each of patches 1 to 10 fails on the > current code and passes with its patch. > > Patch 11 is hardening on top: it adds dp_packet_l3_hdr() and > dp_packet_l4_hdr(), which return a header only when the packet holds > it, and makes the L3 and L4 field setters use them. It is not needed > for backports. > > The related testsuite sections pass with the whole series under > AddressSanitizer. > > Please apply the patches as they are (git am), so that they keep their > author; change anything you like in review. The patches are attached. > > v2: > - Posted to ovs-dev as one series, as the security team asked. > - ND: fixed the loops in place, no new helper. > - set_arp(): new minimal fix (patch 10); the accessor patch is now > hardening only and comes last. > - Tests: raw hex packets with a comment per header, > OVS_WAIT_UNTIL_EQUAL, time/warp under AT_CHECK, add_of_ports. > - Shorter comments and commit messages. > > Alejandro Pacheco (11): > packets: Fix ND option walk in packet_set_nd(). > conntrack: Require a full chunk header in SCTP length check. > conntrack: Use ICMP handlers only for their own address family. > packets: Leave the checksum of a truncated TCP or SCTP header alone. > netdev-native-tnl: Check GTP-U header length on pop. > netdev-native-tnl: Check ERSPAN header length before reading it. > netdev-native-tnl: Check GRE base header length before reading it. > packets: Validate NSH header before set or pop. > dp-packet: Clear layer offsets and offloads on output truncation. > odp-execute: Check ARP header length in set_arp(). > packets: Check header length in L3 and L4 field setters. > > lib/conntrack.c | 27 +++-- > lib/dp-packet.c | 56 ++++++++++ > lib/dp-packet.h | 34 +++++- > lib/dpif.c | 2 +- > lib/netdev-native-tnl.c | 56 ++++++---- > lib/odp-execute.c | 65 +++++++---- > lib/packets.c | 161 ++++++++++++++++++++-------- > lib/packets.h | 27 +++++ > tests/dpif-netdev.at | 64 +++++++++++ > tests/nsh.at | 36 +++++++ > tests/ofproto-dpif.at | 178 +++++++++++++++++++++++++++++++ > tests/test-packets.c | 243 > ++++++++++++++++++++++++++++++++++++++++++ > tests/tunnel-push-pop-ipv6.at | 14 +++ > tests/tunnel-push-pop.at | 80 ++++++++++++++ > 14 files changed, 949 insertions(+), 94 deletions(-) >
Hi, Alejandro. The ovs-dev mailing list scrubs the attachments. You need to send them as separate emails in reply to the cover letter. The easiest way to do that is by using 'git send-email' for sending. Same for the other sets you posted. Best regards, Ilya Maximets. _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
