Ilya Maximets <[email protected]> writes: > OVS_PACKET_CMD_EXECUTE has 3 main attributes: > - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. > - OVS_PACKET_ATTR_PACKET - Binary packet content. > - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. > > OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure > with the metadata like conntrack state, input port, recirculation id, > etc. Then the packet itself gets parsed to populate the rest of the > keys from the packet headers. > > Whenever the packet parsing code starts parsing the ICMPv6 header, it > first zeroes out fields in the key corresponding to Neighbor Discovery > information even if it is not an ND packet. > > It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares > the space between 'nd' and 'ct_orig' that holds the original tuple > conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. > > ND packets should not normally have conntrack state, so it's fine to > share the space, but normal ICMPv6 Echo packets or maybe other types of > ICMPv6 can have the state attached and it should not be overwritten. > > The issue results in all but the last 4 bytes of the destination > address being wiped from the original conntrack tuple leading to > incorrect packet matching and potentially executing wrong actions > in case this packet recirculates within the datapath or goes back > to userspace. > > ND fields should not be accessed in non-ND packets, so not clearing > them should be fine. Executing memset() only for actual ND packets to > avoid the issue. > > Initializing the whole thing before parsing is needed because ND packet > may not contain all the options. > > The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't > affect packets entering OVS datapath from network interfaces, because > in this case CT metadata is populated from skb after the packet is > already parsed. > > Fixes: 9dd7f8907c37 ("openvswitch: Add original direction conntrack > tuple to sw_flow_key.") > Reported-by: Antonin Bas <[email protected]> > Closes: https://github.com/openvswitch/ovs-issues/issues/327 > Signed-off-by: Ilya Maximets <[email protected]> > ---
Acked-by: Aaron Conole <[email protected]> > Note: I'm working on a selftest for this issue, but it requires some > ground work first to add support for OVS_PACKET_CMD_EXECUTE into > opnevswitch selftests as well as parsing of ct tuples. So it is going > to be a separate patch set. I do have something already to do this for an issue in CMD_EXECUTE that I'm debugging (may be the same?). I can reply with my work off-list if you think it would be useful to you. > net/openvswitch/flow.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > index 33b21a0c0548..8a848ce72e29 100644 > --- a/net/openvswitch/flow.c > +++ b/net/openvswitch/flow.c > @@ -561,7 +561,6 @@ static int parse_icmpv6(struct sk_buff *skb, struct > sw_flow_key *key, > */ > key->tp.src = htons(icmp->icmp6_type); > key->tp.dst = htons(icmp->icmp6_code); > - memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); > > if (icmp->icmp6_code == 0 && > (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION || > @@ -570,6 +569,8 @@ static int parse_icmpv6(struct sk_buff *skb, struct > sw_flow_key *key, > struct nd_msg *nd; > int offset; > > + memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); > + > /* In order to process neighbor discovery options, we need the > * entire packet. > */ _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
