mbox series

[ovs-dev,v5,0/6] ipf: Reject IPv4/v6 fragments with wrapping bounds.

Message ID 20260819102529.167827-1-elibr@nvidia.com
Headers show
Series ipf: Reject IPv4/v6 fragments with wrapping bounds. | expand

Message

Eli Britstein Aug. 19, 2026, 10:25 a.m. UTC 
The ipf module calculates fragment bounds with uint16_t, that can be
wrapped around, causing access to invalid memory.  Fix it.
Other commits are supporting this fix.

v3-v2:
- Added ipf: Drop overlap fragments.
- Added ofproto-dpif: Use strip_recirc in reassembly dump-flows checks.
- Zero-payload commit now focuses only on adding an additional byte to
  the test, as the new bounds commit would reject it otherwise.
- Wrapping bounds - separated checks for rest_len <= 0.

v4-v3:
- Added 2 more commits.
- Wrapping bounds - added a TOO_LARGE counter.

v5-v4:
- Added a test coverage for drop overlap fragments.
- Fixed a wrongly counted IPv6 too-large counter.
- Added BEYOND_LAST counter.

Eli Britstein (6):
  ipf: Drop overlap fragments.
  ofproto-dpif: Use strip_recirc in reassembly dump-flows checks.
  ofproto-dpif: Fix reassembly test for zero-payload frags.
  ipf: Reject IPv4/v6 fragments with wrapping bounds.
  ipf: Detect fully containing overlapping fragments.
  ipf: Reject fragments beyond the last fragment.

 lib/dpctl.c                      |   8 +
 lib/dpif-provider.h              |   2 +
 lib/ipf.c                        | 141 ++++++++++++---
 lib/ipf.h                        |   2 +
 tests/ofproto-dpif.at            | 299 ++++++++++++++++++++++++++++---
 tests/system-userspace-macros.at |  16 ++
 6 files changed, 416 insertions(+), 52 deletions(-)