From patchwork Sat Sep 12 01:59:17 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jesse Gross X-Patchwork-Id: 517062 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from archives.nicira.com (li376-54.members.linode.com [96.126.127.54]) by ozlabs.org (Postfix) with ESMTP id A01071401AD for ; Sat, 12 Sep 2015 11:59:27 +1000 (AEST) Received: from archives.nicira.com (localhost [127.0.0.1]) by archives.nicira.com (Postfix) with ESMTP id 7CB2110C65; Fri, 11 Sep 2015 18:59:26 -0700 (PDT) X-Original-To: dev@openvswitch.org Delivered-To: dev@openvswitch.org Received: from mx1e4.cudamail.com (mx1.cudamail.com [69.90.118.67]) by archives.nicira.com (Postfix) with ESMTPS id 334AD10C64 for ; Fri, 11 Sep 2015 18:59:25 -0700 (PDT) Received: from bar5.cudamail.com (unknown [192.168.21.12]) by mx1e4.cudamail.com (Postfix) with ESMTPS id 0B4F81E0068 for ; Fri, 11 Sep 2015 19:59:24 -0600 (MDT) X-ASG-Debug-ID: 1442023163-09eadd2a4047530001-byXFYA Received: from mx1-pf2.cudamail.com ([192.168.24.2]) by bar5.cudamail.com with ESMTP id qB9tp8OACMVvDLej (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Fri, 11 Sep 2015 19:59:23 -0600 (MDT) X-Barracuda-Envelope-From: jesse@nicira.com X-Barracuda-RBL-Trusted-Forwarder: 192.168.24.2 Received: from unknown (HELO mail-pa0-f41.google.com) (209.85.220.41) by mx1-pf2.cudamail.com with ESMTPS (RC4-SHA encrypted); 12 Sep 2015 01:59:23 -0000 Received-SPF: unknown (mx1-pf2.cudamail.com: Multiple SPF records returned) X-Barracuda-RBL-Trusted-Forwarder: 209.85.220.41 Received: by pacex6 with SMTP id ex6so89995895pac.0 for ; Fri, 11 Sep 2015 18:59:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:subject:date:message-id; bh=Ep4/Tg2173cbygTVOf1egyujddBZjpIfd5QSAmYOCDY=; b=igWJ4YEopa2/rpyffizXlPZTgK2L60Ttggw9U+UdlUlsI3hoP0k9ZFOK0qxMs1SxWA 0MHc4FSZfYLAwqtdPoGutcy4Z+4e2J43Qlhyi3Tg9ok6LEsUNxYaBQ7oIgce+KF64EEG AjXZeEmIC6a9SOHsmfCZcz6o1RvPDjtEhoVDKeJRL9MdH6OHsZV+JJDhtFtfPmB3E3uU iztPJpk/0fnvyGDI47J7bGbb51k2hcjvaO39y6QS07O8r7O90nn1ec4THdw756d8OYTh qv6WQHS55QrH7CcJ9LMRvbW+zPdTYjXsnnT6ZkGsg8hV3nSmn939asCP4TnxRs3sJJGi UqhQ== X-Gm-Message-State: ALoCoQkogFO9cBpqFhcLR972zlMx0OB4bbGZgOercO+ZCZi/vmolBYJQCgTtLuf4blgC5mmXsExQ X-Received: by 10.69.26.196 with SMTP id ja4mr4046990pbd.121.1442023162095; Fri, 11 Sep 2015 18:59:22 -0700 (PDT) Received: from ubuntu.localdomain (c-71-202-123-143.hsd1.ca.comcast.net. [71.202.123.143]) by smtp.gmail.com with ESMTPSA id rb8sm2720078pbb.63.2015.09.11.18.59.20 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 11 Sep 2015 18:59:20 -0700 (PDT) X-CudaMail-Envelope-Sender: jesse@nicira.com X-Barracuda-Apparent-Source-IP: 71.202.123.143 From: Jesse Gross To: dev@openvswitch.org X-CudaMail-Whitelist-To: dev@openvswitch.org X-CudaMail-MID: CM-E2-910091657 X-CudaMail-DTE: 091115 X-CudaMail-Originating-IP: 209.85.220.41 Date: Fri, 11 Sep 2015 18:59:17 -0700 X-ASG-Orig-Subj: [##CM-E2-910091657##][PATCH] tunnel: Validate IP header for userspace tunneling. Message-Id: <1442023157-53050-1-git-send-email-jesse@nicira.com> X-Mailer: git-send-email 2.1.4 X-Barracuda-Connect: UNKNOWN[192.168.24.2] X-Barracuda-Start-Time: 1442023163 X-Barracuda-Encrypted: DHE-RSA-AES256-SHA X-Barracuda-URL: https://web.cudamail.com:443/cgi-mod/mark.cgi X-ASG-Whitelist: Header =?UTF-8?B?eFwtY3VkYW1haWxcLXdoaXRlbGlzdFwtdG8=?= X-Virus-Scanned: by bsmtpd at cudamail.com X-Barracuda-BRTS-Status: 1 Subject: [ovs-dev] [PATCH] tunnel: Validate IP header for userspace tunneling. X-BeenThere: dev@openvswitch.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dev-bounces@openvswitch.org Sender: "dev" Currently, when doing userspace tunneling we don't perform much in the way of integrity checks on the incoming IP header. The case of tunneling is different from the usual case of switching since we are acting as the endpoint here and should not allow invalid packets to pass. This adds checks for IP checksum, version, total length, and options and drops packets that don't pass. Signed-off-by: Jesse Gross Acked-by: Pravin B Shelar --- lib/netdev-vport.c | 27 +++++++++++++++++++++++++++ tests/tunnel-push-pop.at | 6 +++--- 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/lib/netdev-vport.c b/lib/netdev-vport.c index eceaa81..ff50563 100644 --- a/lib/netdev-vport.c +++ b/lib/netdev-vport.c @@ -844,6 +844,7 @@ ip_extract_tnl_md(struct dp_packet *packet, struct flow_tnl *tnl) { struct ip_header *nh; void *l4; + int l3_size; nh = dp_packet_l3(packet); l4 = dp_packet_l4(packet); @@ -852,6 +853,32 @@ ip_extract_tnl_md(struct dp_packet *packet, struct flow_tnl *tnl) return NULL; } + if (csum(nh, IP_IHL(nh->ip_ihl_ver) * 4)) { + VLOG_WARN_RL(&err_rl, "ip packet has invalid checksum"); + return NULL; + } + + if (IP_VER(nh->ip_ihl_ver) != 4) { + VLOG_WARN_RL(&err_rl, "ipv4 packet has invalid version (%d)", + IP_VER(nh->ip_ihl_ver)); + return NULL; + } + + l3_size = dp_packet_size(packet) - + ((char *)nh - (char *)dp_packet_data(packet)); + + if (ntohs(nh->ip_tot_len) > l3_size) { + VLOG_WARN_RL(&err_rl, "ip packet is truncated (IP length %d, actual %d)", + ntohs(nh->ip_tot_len), l3_size); + return NULL; + } + + if (IP_IHL(nh->ip_ihl_ver) * 4 > sizeof(struct ip_header)) { + VLOG_WARN_RL(&err_rl, "ip options not supported on tunnel packets " + "(%d bytes)", IP_IHL(nh->ip_ihl_ver) * 4); + return NULL; + } + tnl->ip_src = get_16aligned_be32(&nh->ip_src); tnl->ip_dst = get_16aligned_be32(&nh->ip_dst); tnl->ip_tos = nh->ip_tos; diff --git a/tests/tunnel-push-pop.at b/tests/tunnel-push-pop.at index 502e41f..98f22ea 100644 --- a/tests/tunnel-push-pop.at +++ b/tests/tunnel-push-pop.at @@ -109,7 +109,7 @@ AT_CHECK([tail -1 stdout], [0], ]) dnl Check decapsulation of GRE packet -AT_CHECK([ovs-appctl netdev-dummy/receive p0 'aa55aa550000001b213cab6408004500007e79464000402f99080101025c0101025820006558000001c8fe71d883724fbeb6f4e1494a080045000054ba200000400184861e0000011e00000200004227e75400030af3195500000000f265010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637']) +AT_CHECK([ovs-appctl netdev-dummy/receive p0 'aa55aa550000001b213cab6408004500007e79464000402fba550101025c0101025820006558000001c8fe71d883724fbeb6f4e1494a080045000054ba200000400184861e0000011e00000200004227e75400030af3195500000000f265010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637']) ovs-appctl time/warp 1000 AT_CHECK([ovs-ofctl dump-ports int-br | grep 'port 3'], [0], [dnl @@ -117,7 +117,7 @@ AT_CHECK([ovs-ofctl dump-ports int-br | grep 'port 3'], [0], [dnl ]) dnl Check GRE only accepts encapsulated Ethernet frames -AT_CHECK([ovs-appctl netdev-dummy/receive p0 'aa55aa550000001b213cab6408004500007e79464000402f99080101025c0101025820000800000001c8fe71d883724fbeb6f4e1494a080045000054ba200000400184861e0000011e00000200004227e75400030af3195500000000f265010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637']) +AT_CHECK([ovs-appctl netdev-dummy/receive p0 'aa55aa550000001b213cab6408004500007e79464000402fba550101025c0101025820000800000001c8fe71d883724fbeb6f4e1494a080045000054ba200000400184861e0000011e00000200004227e75400030af3195500000000f265010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637']) ovs-appctl time/warp 1000 AT_CHECK([ovs-ofctl dump-ports int-br | grep 'port 3'], [0], [dnl @@ -130,7 +130,7 @@ AT_CHECK([ovs-ofctl monitor int-br 65534 --detach --no-chdir --pidfile 2> ofctl_ AT_CHECK([ovs-ofctl del-flows int-br]) AT_CHECK([ovs-ofctl add-flow int-br "tun_metadata0=0xa/0xf,actions=5,controller"]) -AT_CHECK([ovs-appctl netdev-dummy/receive p0 'aa55aa550000001b213cab64080045000096794640004011ba630101025c01010258308817c1008200000400655800007b00ffff80010000000affff00010000000bfe71d883724fbeb6f4e1494a080045000054ba200000400184861e0000011e00000200004227e75400030af3195500000000f265010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637']) +AT_CHECK([ovs-appctl netdev-dummy/receive p0 'aa55aa550000001b213cab64080045000096794640004011ba5b0101025c01010258308817c1008200000400655800007b00ffff80010000000affff00010000000bfe71d883724fbeb6f4e1494a080045000054ba200000400184861e0000011e00000200004227e75400030af3195500000000f265010000000000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031323334353637']) OVS_WAIT_UNTIL([test `wc -l < ofctl_monitor.log` -ge 2]) OVS_APP_EXIT_AND_WAIT(ovs-ofctl)