From patchwork Wed Feb 10 14:39:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilya Maximets X-Patchwork-Id: 1438990 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.137; helo=fraxinus.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4DbMqy3wCLz9sTD for ; Thu, 11 Feb 2021 01:40:29 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 4FADD865DB; Wed, 10 Feb 2021 14:40:28 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H5Yq-_xAMPJd; Wed, 10 Feb 2021 14:40:25 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by fraxinus.osuosl.org (Postfix) with ESMTP id BC4A386885; Wed, 10 Feb 2021 14:40:23 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 90AA5C0891; Wed, 10 Feb 2021 14:40:23 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id A2BD3C0174 for ; Wed, 10 Feb 2021 14:40:20 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 9A8E286A74 for ; Wed, 10 Feb 2021 14:40:20 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4XuFc5a3kvPx for ; Wed, 10 Feb 2021 14:40:14 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from relay8-d.mail.gandi.net (relay8-d.mail.gandi.net [217.70.183.201]) by whitealder.osuosl.org (Postfix) with ESMTPS id E2D5C866AF for ; Wed, 10 Feb 2021 14:40:12 +0000 (UTC) X-Originating-IP: 78.45.89.65 Received: from im-t490s.redhat.com (ip-78-45-89-65.net.upcbroadband.cz [78.45.89.65]) (Authenticated sender: i.maximets@ovn.org) by relay8-d.mail.gandi.net (Postfix) with ESMTPSA id BE7DC1BF216; Wed, 10 Feb 2021 14:40:10 +0000 (UTC) From: Ilya Maximets To: ovs-dev@openvswitch.org Date: Wed, 10 Feb 2021 15:39:43 +0100 Message-Id: <20210210143950.2950378-6-i.maximets@ovn.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20210210143950.2950378-1-i.maximets@ovn.org> References: <20210210143950.2950378-1-i.maximets@ovn.org> MIME-Version: 1.0 Cc: Flavio Leitner , Joakim Hindersson , Ilya Maximets Subject: [ovs-dev] [PATCH branch-2.13] flow: Support extra padding length. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" From: Flavio Leitner Although not required, padding can be optionally added until the packet length is MTU bytes. A packet with extra padding currently fails sanity checks. Vulnerability: CVE-2020-35498 Fixes: fa8d9001a624 ("miniflow_extract: Properly handle small IP packets.") Reported-by: Joakim Hindersson Acked-by: Ilya Maximets Signed-off-by: Flavio Leitner Signed-off-by: Ilya Maximets --- lib/conntrack.c | 2 +- lib/dp-packet.h | 10 +++++----- lib/flow.c | 6 +++--- tests/classifier.at | 36 ++++++++++++++++++++++++++++++++++++ 4 files changed, 45 insertions(+), 9 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 0cbc8f6d2..bb98395cd 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -813,7 +813,7 @@ static void reverse_nat_packet(struct dp_packet *pkt, const struct conn *conn) { char *tail = dp_packet_tail(pkt); - uint8_t pad = dp_packet_l2_pad_size(pkt); + uint16_t pad = dp_packet_l2_pad_size(pkt); struct conn_key inner_key; const char *inner_l4 = NULL; uint16_t orig_l3_ofs = pkt->l3_ofs; diff --git a/lib/dp-packet.h b/lib/dp-packet.h index 9f8991faa..45655af46 100644 --- a/lib/dp-packet.h +++ b/lib/dp-packet.h @@ -81,7 +81,7 @@ struct dp_packet { /* All the following elements of this struct are copied in a single call * of memcpy in dp_packet_clone_with_headroom. */ - uint8_t l2_pad_size; /* Detected l2 padding size. + uint16_t l2_pad_size; /* Detected l2 padding size. * Padding is non-pullable. */ uint16_t l2_5_ofs; /* MPLS label stack offset, or UINT16_MAX */ uint16_t l3_ofs; /* Network-level header offset, @@ -118,8 +118,8 @@ void *dp_packet_resize_l2(struct dp_packet *, int increment); void *dp_packet_resize_l2_5(struct dp_packet *, int increment); static inline void *dp_packet_eth(const struct dp_packet *); static inline void dp_packet_reset_offsets(struct dp_packet *); -static inline uint8_t dp_packet_l2_pad_size(const struct dp_packet *); -static inline void dp_packet_set_l2_pad_size(struct dp_packet *, uint8_t); +static inline uint16_t dp_packet_l2_pad_size(const struct dp_packet *); +static inline void dp_packet_set_l2_pad_size(struct dp_packet *, uint16_t); static inline void *dp_packet_l2_5(const struct dp_packet *); static inline void dp_packet_set_l2_5(struct dp_packet *, void *); static inline void *dp_packet_l3(const struct dp_packet *); @@ -327,14 +327,14 @@ dp_packet_reset_offsets(struct dp_packet *b) b->l4_ofs = UINT16_MAX; } -static inline uint8_t +static inline uint16_t dp_packet_l2_pad_size(const struct dp_packet *b) { return b->l2_pad_size; } static inline void -dp_packet_set_l2_pad_size(struct dp_packet *b, uint8_t pad_size) +dp_packet_set_l2_pad_size(struct dp_packet *b, uint16_t pad_size) { ovs_assert(pad_size <= dp_packet_size(b)); b->l2_pad_size = pad_size; diff --git a/lib/flow.c b/lib/flow.c index 45bb96b54..353d5cd3e 100644 --- a/lib/flow.c +++ b/lib/flow.c @@ -655,7 +655,7 @@ ipv4_sanity_check(const struct ip_header *nh, size_t size, tot_len = ntohs(nh->ip_tot_len); if (OVS_UNLIKELY(tot_len > size || ip_len > tot_len || - size - tot_len > UINT8_MAX)) { + size - tot_len > UINT16_MAX)) { return false; } @@ -693,8 +693,8 @@ ipv6_sanity_check(const struct ovs_16aligned_ip6_hdr *nh, size_t size) if (OVS_UNLIKELY(plen + IPV6_HEADER_LEN > size)) { return false; } - /* Jumbo Payload option not supported yet. */ - if (OVS_UNLIKELY(size - (plen + IPV6_HEADER_LEN) > UINT8_MAX)) { + + if (OVS_UNLIKELY(size - (plen + IPV6_HEADER_LEN) > UINT16_MAX)) { return false; } diff --git a/tests/classifier.at b/tests/classifier.at index 88818618b..cdcd72c15 100644 --- a/tests/classifier.at +++ b/tests/classifier.at @@ -304,3 +304,39 @@ ovs-ofctl: "conjunction" actions may be used along with "note" but not any other ]) OVS_VSWITCHD_STOP AT_CLEANUP + +# Flow classifier a packet with excess of padding. +AT_SETUP([flow classifier - packet with extra padding]) +OVS_VSWITCHD_START +add_of_ports br0 1 2 +AT_DATA([flows.txt], [dnl +priority=5,ip,ip_dst=1.1.1.1,actions=1 +priority=5,ip,ip_dst=1.1.1.2,actions=2 +priority=0,actions=drop +]) +AT_CHECK([ovs-ofctl add-flows br0 flows.txt]) +packet=00020202020000010101010008004500001c00010000401176cc01010101010101020d6a00350008ee3a +AT_CHECK([ovs-appctl ofproto/trace br0 in_port=1 $packet] , [0], [stdout]) +AT_CHECK([tail -2 stdout], [0], + [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_dst=1.1.1.2,nw_frag=no +Datapath actions: 2 +]) +# normal packet plus 255 bytes of padding (8bit padding). +# 255 * 2 = 510 +padding=$(printf '%*s' 510 | tr ' ' '0') +AT_CHECK([ovs-appctl ofproto/trace br0 in_port=1 ${packet}${padding}] , [0], [stdout]) +AT_CHECK([tail -2 stdout], [0], + [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_dst=1.1.1.2,nw_frag=no +Datapath actions: 2 +]) +# normal packet plus padding up to 65535 bytes of length (16bit limit). +# 65535 - 43 = 65492 +# 65492 * 2 = 130984 +padding=$(printf '%*s' 130984 | tr ' ' '0') +AT_CHECK([ovs-appctl ofproto/trace br0 in_port=1 ${packet}${padding}], [0], [stdout]) +AT_CHECK([tail -2 stdout], [0], + [Megaflow: recirc_id=0,eth,ip,in_port=1,nw_dst=1.1.1.2,nw_frag=no +Datapath actions: 2 +]) +OVS_VSWITCHD_STOP +AT_CLEANUP