From patchwork Wed Sep 12 09:16:46 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zang MingJie X-Patchwork-Id: 968920 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="hlBHiTKB"; dkim-atps=neutral Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 429GR01yvfz9s3l for ; Wed, 12 Sep 2018 19:18:03 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id DC182D6B; Wed, 12 Sep 2018 09:18:01 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 38633D6A for ; Wed, 12 Sep 2018 09:18:01 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 2D834102 for ; Wed, 12 Sep 2018 09:18:00 +0000 (UTC) Received: by mail-pg1-f173.google.com with SMTP id v66-v6so728620pgb.10 for ; Wed, 12 Sep 2018 02:18:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=hWtqJIeinTYJu1R30gwGt/opH7ncFnD2wGNBzxDM2BM=; b=hlBHiTKBxAfmaT6g9WmJCQV1WjdxFTmLQNrVeeHoRgfnr7WJ0vwZHVR4lsCscrm5/S NASnWzol2tcv1EutLOB8rNxzVMCFgf0nR4PJVtHBDrzT7Dy+iBMeYd/zoMoUMlVPmNro mwVPTEmOYOJh89wautpEPJfzoSjkSqIaqIhbBfp/vCfd9r+peC8XRK4IyPEirFvm65JG 3Vt810yWy3ZktVXtECrSQOoL8s+tiTztzWNIvjD700+pNe0JYB5hYxOyAEZaUGv8iTRz AXIrncpWGnEWIrAxvasKPYFwlRmSaCtkqmEE6tkecwE68sAEHOOuo+eV4A0i7qjthy+3 6wbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=hWtqJIeinTYJu1R30gwGt/opH7ncFnD2wGNBzxDM2BM=; b=mPM2oM/tAMhN2mLOWfOYOk4QwIO87JuVatRlQ67m51E2LHJAxBn4KaTp34dydnNhcW H61EFmirJ00YoBR/DBaReVbnxzQwqi7PDzzStzJVvOSs+CbZEV0uyO4Ks/V5kltZp0vw EUHpWfnD75xI7ATtA3k+auulRPXWXAfJL5g9NxHaIVC1Xdn3Rzveb1xjepyT4B9ozOWs EckHxjy5ark/dW6JTyPSSOrf+h0iZohd4awR5m/5LnfSuSsEuhLTuxilxmVO69QwzU/2 JaaWySMUnyedAHZZAQVJ2V8ftImgQTQPlgxtf4K6zQCh8xDSu9tIG90ZYA8Tsx21byco Shew== X-Gm-Message-State: APzg51Brw9+qvHjxzERl2p+JvpgJ3YwBhWa09ij0rAJUsJl7T4Ucr5+S OaZEc0armsam9QxWKJVpJ/qAGjfqpRA= X-Google-Smtp-Source: ANB0VdZbl/yPo/LDVzWhVHhXhmnrrH8aUFQPhTMJ0k3qs3LrGImp6ULNlDOZWkcPf8KYKcD0mybfXA== X-Received: by 2002:a63:fd06:: with SMTP id d6-v6mr1092232pgh.348.1536743879384; Wed, 12 Sep 2018 02:17:59 -0700 (PDT) Received: from localhost.localdomain (li414-6.members.linode.com. [106.187.94.6]) by smtp.gmail.com with ESMTPSA id r18-v6sm809047pgj.51.2018.09.12.02.17.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 12 Sep 2018 02:17:58 -0700 (PDT) From: Zang MingJie To: dev@openvswitch.org Date: Wed, 12 Sep 2018 17:16:46 +0800 Message-Id: <20180912091646.24249-1-zealot0630@gmail.com> X-Mailer: git-send-email 2.19.0.rc1 MIME-Version: 1.0 X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH] conntrack: invalid packet should not modify ct state X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org When encounter an invalid packet, all changes made by the packet should be reverted. Currently an invalid packet can change the seq number while the connection is in SEQ_RECV state. Signed-off-by: Zang MingJie --- lib/conntrack-tcp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/conntrack-tcp.c b/lib/conntrack-tcp.c index 86d313d28..7443a3293 100644 --- a/lib/conntrack-tcp.c +++ b/lib/conntrack-tcp.c @@ -151,9 +151,9 @@ tcp_conn_update(struct conn *conn_, struct conntrack_bucket *ctb, struct conn_tcp *conn = conn_tcp_cast(conn_); struct tcp_header *tcp = dp_packet_l4(pkt); /* The peer that sent 'pkt' */ - struct tcp_peer *src = &conn->peer[reply ? 1 : 0]; + struct tcp_peer orig_src, *src = &conn->peer[reply ? 1 : 0]; /* The peer that should receive 'pkt' */ - struct tcp_peer *dst = &conn->peer[reply ? 0 : 1]; + struct tcp_peer orig_dst, *dst = &conn->peer[reply ? 0 : 1]; uint8_t sws = 0, dws = 0; uint16_t tcp_flags = TCP_FLAGS(tcp->tcp_ctl); @@ -187,6 +187,10 @@ tcp_conn_update(struct conn *conn_, struct conntrack_bucket *ctb, dws = TCP_MAX_WSCALE; } + + orig_src = *src; + orig_dst = *dst; + /* * Sequence tracking algorithm from Guido van Rooij's paper: * http://www.madison-gurkha.com/publications/tcp_filtering/ @@ -385,6 +389,8 @@ tcp_conn_update(struct conn *conn_, struct conntrack_bucket *ctb, src->state = dst->state = CT_DPIF_TCPS_TIME_WAIT; } } else { + *src = orig_src; + *dst = orig_dst; return CT_UPDATE_INVALID; }