Aaron Conole via dev <[email protected]> writes: > The FTP ALG handling for IPv4 and IPv6 is guarded from overwriting the > buffer space by checking the headroom + tail-room against the rewrite > delta. However, when a packet needs to be expanded, only the > tail-room is actually available. The guard itself allows > modifications to pass that may otherwise be flagged. > > Fix this by only checking that the tail-room has sufficient space to > handle the packet growth. This is a bit different as we no longer > check the delta, but just the actual expansion room available. This > check is a bit more conservative, so there could be an edge-case > packet that used to pass through the checks but no longer > would. > > The FTP ALG unit tests are updated to correct a comment about the > guard design, and test for the new condition. > > Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.") > Reported-by: VinÃcius Rodrigues <[email protected]> > Assisted-by: Claude Sonnet 4.5, Claude Opus > Signed-off-by: Aaron Conole <[email protected]> > ---
Recheck-request: github-robot _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
