On 10/15/26 2:47 PM, Fernando Fernandez Mancera wrote:
> An IPv4 later fragment carries no L4 header, but key extraction leaves
> ip.proto set to the real protocol and the flow may wildcard the frag
> field, so validate_set() accepts such packets. set_tcp() and set_udp()
> then treat the first bytes of the fragment payload as an L4 header,
> rewrite them as ports and patch the bytes at the checksum offset,
> corrupting the packet.
>
> Skip these actions for OVS_FRAG_TYPE_LATER. IPv6 later fragments are not
> affected, since their ip.proto is NEXTHDR_FRAGMENT and validate_set()
> rejects L4 set actions for them.
>
> Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.")
> Signed-off-by: Fernando Fernandez Mancera <[email protected]>
> ---
> net/openvswitch/actions.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
> index 27152bca8a8c..4aade471afc4 100644
> --- a/net/openvswitch/actions.c
> +++ b/net/openvswitch/actions.c
> @@ -595,6 +595,9 @@ static int set_udp(struct sk_buff *skb, struct
> sw_flow_key *flow_key,
> __be16 src, dst;
> int err;
>
> + if (flow_key->ip.frag == OVS_FRAG_TYPE_LATER)
> + return 0;
> +
> err = skb_ensure_writable(skb, skb_transport_offset(skb) +
> sizeof(struct udphdr));
> if (unlikely(err))
> @@ -638,6 +641,9 @@ static int set_tcp(struct sk_buff *skb, struct
> sw_flow_key *flow_key,
> __be16 src, dst;
> int err;
>
> + if (flow_key->ip.frag == OVS_FRAG_TYPE_LATER)
> + return 0;
> +
> err = skb_ensure_writable(skb, skb_transport_offset(skb) +
> sizeof(struct tcphdr));
> if (unlikely(err))
Ideally, we would not allow this actions to be installed in the first place,
but that would require quite a bit of rework in the flow parsing and needs
some extra assessment on the uAPI impact. Though it would be a more complete
fix and LLMs may complain that the current patch is not. But, IMO, it's
good enough for what it is trying to achieve right now.
Reviewed-by: Ilya Maximets <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
