{"id":808446,"url":"http://patchwork.ozlabs.org/api/1.0/patches/808446/?format=json","project":{"id":7,"url":"http://patchwork.ozlabs.org/api/1.0/projects/7/?format=json","name":"Linux network development","link_name":"netdev","list_id":"netdev.vger.kernel.org","list_email":"netdev@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20170831222239.21509-3-tom@quantonium.net>","date":"2017-08-31T22:22:39","name":"[net-next,2/2] flow_dissector: Add limits for encapsulation and EH","commit_ref":null,"pull_url":null,"state":"superseded","archived":true,"hash":"1940d62f0de68705df134b5f9ecb88eb3e9ffd20","submitter":{"id":72064,"url":"http://patchwork.ozlabs.org/api/1.0/people/72064/?format=json","name":"Tom Herbert","email":"tom@quantonium.net"},"delegate":{"id":34,"url":"http://patchwork.ozlabs.org/api/1.0/users/34/?format=json","username":"davem","first_name":"David","last_name":"Miller","email":"davem@davemloft.net"},"mbox":"http://patchwork.ozlabs.org/project/netdev/patch/20170831222239.21509-3-tom@quantonium.net/mbox/","series":[{"id":914,"url":"http://patchwork.ozlabs.org/api/1.0/series/914/?format=json","date":"2017-08-31T22:22:37","name":"flow_dissector: Flow dissector fixes","version":1,"mbox":"http://patchwork.ozlabs.org/series/914/mbox/"}],"check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/808446/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":["ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","ozlabs.org; dkim=pass (2048-bit key;\n\tunprotected) header.d=quantonium-net.20150623.gappssmtp.com\n\theader.i=@quantonium-net.20150623.gappssmtp.com\n\theader.b=\"U3VCDE6v\"; dkim-atps=neutral"],"Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xjxjy180Gz9s7f\n\tfor ;\n\tFri, 1 Sep 2017 08:24:06 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751803AbdHaWYE (ORCPT );\n\tThu, 31 Aug 2017 18:24:04 -0400","from mail-pg0-f54.google.com ([74.125.83.54]:37751 \"EHLO\n\tmail-pg0-f54.google.com\" rhost-flags-OK-OK-OK-OK) by vger.kernel.org\n\twith ESMTP id S1751205AbdHaWYD (ORCPT\n\t); Thu, 31 Aug 2017 18:24:03 -0400","by mail-pg0-f54.google.com with SMTP id 83so2710765pgb.4\n\tfor ; Thu, 31 Aug 2017 15:24:03 -0700 (PDT)","from localhost.localdomain (c-73-162-13-107.hsd1.ca.comcast.net.\n\t[73.162.13.107]) by smtp.gmail.com with ESMTPSA id\n\to22sm772493pgn.59.2017.08.31.15.24.01\n\t(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);\n\tThu, 31 Aug 2017 15:24:01 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=quantonium-net.20150623.gappssmtp.com; s=20150623;\n\th=from:to:cc:subject:date:message-id:in-reply-to:references;\n\tbh=B8zTdpQNCSp0XHgXtA3qQiZzxjTfTQoQE6C0JZEQ/8Q=;\n\tb=U3VCDE6vG2t9UMSOwHX3hwlWSmnW2EnFiXhC0zjt11VaC0Br/TpUaNZALeOwxZMn/T\n\tU6Ny3EwqDxH9msRBRMXWOU7FwzsfeHX36gMDHzQHAkwQ+E4vbqG0198sm8YxbeN+r4Qt\n\tq3Q49vEPGN1ijfWcf7lrTjj0hNVFIz9B0cJWLyt4TaweWUibt3T+574yqrUmHCSycgV4\n\tunCPlzwcCRUzgFw+UBHfJGldxNrs/71DS6S0F0xRmMFx6l1M6X0huDXp62qMSGcCTsrN\n\tZ7kFg85UdzVOBwJMroQNVn9xE/QWPUlB9bstfodhBgta3GN6xEYIcoejiKD0deYhzYkY\n\t+ZbA==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20161025;\n\th=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to\n\t:references;\n\tbh=B8zTdpQNCSp0XHgXtA3qQiZzxjTfTQoQE6C0JZEQ/8Q=;\n\tb=hhVoG90mD+d/UWLZ2M5RtFOnAIOcZUeBguyrkz53EBSIgmPyxTP8StIDklpcBlksG/\n\tCx83uEc/FE/E0Hyi+gz/wzhbxkOqf3SnM6JxOGFKs4KQKCm8ezQGGhNbXuStQkhibSzm\n\tGwdTg1Sz3uOydbX5zwbUoDOYDvDFoBoT3FTIWEggVeit2QBTB73NvIg+vESN5jitrR0h\n\teIVL9Mn7ZlXBVXQqmp2bMteFeGZVhsmBmai2dUAF2Zm6QTOtkMuZ/O2F/Ltz/IYVwWyg\n\tVyj/kAnsWo1+5t0KP3Yi4AMZ820a0dsSoW6LQaoZEJIp5Pt9ClsUyaFlvJAhGBCDSS2P\n\tk98g==","X-Gm-Message-State":"AHYfb5iOJQqfEmMHNANxRuFeykmIPA3O/OPElerKc2CpCg4wL+ldjbU1\n\trXYS9o6iA4vWlqZK","X-Google-Smtp-Source":"ADKCNb5XqKvvf3/ZL5vU2hSHErquUibq4IGBRDyQiIVff3KpX8Ok0miyb77jwUWgHQcuESFkqfKdwA==","X-Received":"by 10.84.130.39 with SMTP id 36mr4145116plc.143.1504218242778;\n\tThu, 31 Aug 2017 15:24:02 -0700 (PDT)","From":"Tom Herbert ","To":"davem@davemloft.net","Cc":"netdev@vger.kernel.org, alex.popov@linux.com,\n\thannes@stressinduktion.org, Tom Herbert ","Subject":"[PATCH net-next 2/2] flow_dissector: Add limits for encapsulation\n\tand EH","Date":"Thu, 31 Aug 2017 15:22:39 -0700","Message-Id":"<20170831222239.21509-3-tom@quantonium.net>","X-Mailer":"git-send-email 2.11.0","In-Reply-To":"<20170831222239.21509-1-tom@quantonium.net>","References":"<20170831222239.21509-1-tom@quantonium.net>","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"},"content":"In flow dissector there are no limits to the number of nested\nencapsulations that might be dissected which makes for a nice DOS\nattack. This patch limits for dissecting nested encapsulations\nas well as for dissecting over extension headers.\n\nReported-by: Hannes Frederic Sowa \nSigned-off-by: Tom Herbert \n---\n net/core/flow_dissector.c | 48 ++++++++++++++++++++++++++++++++++++++++++++---\n 1 file changed, 45 insertions(+), 3 deletions(-)","diff":"diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c\nindex 5110180a3e96..1bca748de27d 100644\n--- a/net/core/flow_dissector.c\n+++ b/net/core/flow_dissector.c\n@@ -396,6 +396,35 @@ __skb_flow_dissect_ipv6(const struct sk_buff *skb,\n \tkey_ip->ttl = iph->hop_limit;\n }\n \n+/* Maximum number of nested encapsulations that can be processed in\n+ * __skb_flow_dissect\n+ */\n+#define MAX_FLOW_DISSECT_ENCAPS\t5\n+\n+static bool skb_flow_dissect_encap_allowed(int *num_encaps, unsigned int *flags)\n+{\n+\t++*num_encaps;\n+\n+\tif (*num_encaps >= MAX_FLOW_DISSECT_ENCAPS) {\n+\t\tif (*num_encaps == MAX_FLOW_DISSECT_ENCAPS) {\n+\t\t\t/* Allow one more pass but ignore disregard\n+\t\t\t * further encapsulations\n+\t\t\t */\n+\t\t\t*flags |= FLOW_DISSECTOR_F_STOP_AT_ENCAP;\n+\t\t} else {\n+\t\t\t/* Max encaps reached */\n+\t\t\treturn false;\n+\t\t}\n+\t}\n+\n+\treturn true;\n+}\n+\n+/* Maximum number of extension headers can be processed in __skb_flow_dissect\n+ * per IPv6 packet\n+ */\n+#define MAX_FLOW_DISSECT_EH\t5\n+\n /**\n * __skb_flow_dissect - extract the flow_keys struct and return it\n * @skb: sk_buff to extract the flow from, can be NULL if the rest are specified\n@@ -426,6 +455,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,\n \tstruct flow_dissector_key_tags *key_tags;\n \tstruct flow_dissector_key_vlan *key_vlan;\n \tenum flow_dissect_ret fdret;\n+\tint num_eh, num_encaps = 0;\n \tbool skip_vlan = false;\n \tu8 ip_proto = 0;\n \tbool ret;\n@@ -714,7 +744,9 @@ bool __skb_flow_dissect(const struct sk_buff *skb,\n \tcase FLOW_DISSECT_RET_OUT_GOOD:\n \t\tgoto out_good;\n \tcase FLOW_DISSECT_RET_PROTO_AGAIN:\n-\t\tgoto proto_again;\n+\t\tif (skb_flow_dissect_encap_allowed(&num_encaps, &flags))\n+\t\t\tgoto proto_again;\n+\t\tgoto out_good;\n \tcase FLOW_DISSECT_RET_CONTINUE:\n \tcase FLOW_DISSECT_RET_IPPROTO_AGAIN:\n \tcase FLOW_DISSECT_RET_IPPROTO_AGAIN_EH:\n@@ -724,6 +756,8 @@ bool __skb_flow_dissect(const struct sk_buff *skb,\n \t\tgoto out_bad;\n \t}\n \n+\tnum_eh = 0;\n+\n ip_proto_again:\n \tfdret = FLOW_DISSECT_RET_CONTINUE;\n \n@@ -844,10 +878,18 @@ bool __skb_flow_dissect(const struct sk_buff *skb,\n \t/* Process result of IP proto processing */\n \tswitch (fdret) {\n \tcase FLOW_DISSECT_RET_PROTO_AGAIN:\n-\t\tgoto proto_again;\n+\t\tif (skb_flow_dissect_encap_allowed(&num_encaps, &flags))\n+\t\t\tgoto proto_again;\n+\t\tbreak;\n \tcase FLOW_DISSECT_RET_IPPROTO_AGAIN:\n+\t\tif (skb_flow_dissect_encap_allowed(&num_encaps, &flags))\n+\t\t\tgoto ip_proto_again;\n+\t\tbreak;\n \tcase FLOW_DISSECT_RET_IPPROTO_AGAIN_EH:\n-\t\tgoto ip_proto_again;\n+\t\t++num_eh;\n+\t\tif (num_eh <= MAX_FLOW_DISSECT_EH)\n+\t\t\tgoto ip_proto_again;\n+\t\tbreak;\n \tcase FLOW_DISSECT_RET_OUT_GOOD:\n \tcase FLOW_DISSECT_RET_CONTINUE:\n \t\tbreak;\n","prefixes":["net-next","2/2"]}