From: Alejandro Pacheco <[email protected]>
For ARP, nw_proto holds the opcode, so xlate commits a set(arp) action
even when flow extraction found the ARP header too short. set_arp()
only asserts that the L3 offset is set, and then reads and writes the
ARP header past the end of the packet. Leave such packets unchanged.
Fixes: f6c8a6b163af ("Add software switch support for modifying ARP headers in
OpenFlow.")
Assisted-by: claude-opus-5-5, Claude Code
Signed-off-by: Alejandro Pacheco <[email protected]>
---
lib/odp-execute.c | 4 +++-
tests/dpif-netdev.at | 19 +++++++++++++++++++
2 files changed, 22 insertions(+), 1 deletion(-)
diff --git a/lib/odp-execute.c b/lib/odp-execute.c
index a1f338271..29691d5c2 100644
--- a/lib/odp-execute.c
+++ b/lib/odp-execute.c
@@ -304,7 +304,9 @@ set_arp(struct dp_packet *packet, const struct ovs_key_arp
*key,
{
struct arp_eth_header *arp = dp_packet_l3(packet);
- ovs_assert(arp);
+ if (!arp || dp_packet_l3_size(packet) < ARP_ETH_HEADER_LEN) {
+ return;
+ }
if (!mask) {
arp->ar_op = key->arp_op;
diff --git a/tests/dpif-netdev.at b/tests/dpif-netdev.at
index 6ca411460..1dabbcc5f 100644
--- a/tests/dpif-netdev.at
+++ b/tests/dpif-netdev.at
@@ -3819,3 +3819,22 @@ OVS_VSWITCHD_STOP(["dnl
/.*failed to put.*$/d
/.*failed to flow_del.*$/d"])
AT_CLEANUP
+
+AT_SETUP([dpif-netdev - set field on truncated ARP header])
+OVS_VSWITCHD_START
+add_of_ports --pcap br0 1 2
+
+AT_CHECK([ovs-ofctl add-flow br0
"in_port=1,arp,actions=set_field:2->arp_op,2"])
+
+dnl ARP header with 10 of its 28 bytes. It is forwarded unmodified.
+m4_define([ARP_SHORT_PKT], m4_join([],
+dnl eth(src=00:00:00:00:00:01,dst=00:00:00:00:00:02,type=0x0806)
+[0000000000020000000000010806],
+dnl arp(htype=1,ptype=0x0800,hlen=6,plen=4,op=1), first 2 bytes of sha.
+[00010800060400010000]))
+
+AT_CHECK([ovs-appctl netdev-dummy/receive p1 ARP_SHORT_PKT])
+OVS_WAIT_UNTIL_EQUAL([ovs-pcap p2-tx.pcap], [ARP_SHORT_PKT])
+
+OVS_VSWITCHD_STOP
+AT_CLEANUP
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
