From patchwork Tue Mar 12 12:56:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dumitru Ceara X-Patchwork-Id: 1911044 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=TW8Xxzii; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org) Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TvDFP10WPz1yWt for ; Tue, 12 Mar 2024 23:57:29 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id A59E281E89; Tue, 12 Mar 2024 12:57:26 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FoLrC3ncl4ji; Tue, 12 Mar 2024 12:57:25 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.9.56; helo=lists.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org AD073813AB Authentication-Results: smtp1.osuosl.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=TW8Xxzii Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp1.osuosl.org (Postfix) with ESMTPS id AD073813AB; Tue, 12 Mar 2024 12:57:25 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id 87A3FC0072; Tue, 12 Mar 2024 12:57:25 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136]) by lists.linuxfoundation.org (Postfix) with ESMTP id 51191C0037 for ; Tue, 12 Mar 2024 12:57:24 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 408D560B58 for ; Tue, 12 Mar 2024 12:57:24 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3g1ikbpoA0hW for ; Tue, 12 Mar 2024 12:57:23 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=170.10.133.124; helo=us-smtp-delivery-124.mimecast.com; envelope-from=dceara@redhat.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp3.osuosl.org 5F36260B55 Authentication-Results: smtp3.osuosl.org; dmarc=pass (p=none dis=none) header.from=redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 5F36260B55 Authentication-Results: smtp3.osuosl.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=TW8Xxzii Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by smtp3.osuosl.org (Postfix) with ESMTPS id 5F36260B55 for ; Tue, 12 Mar 2024 12:57:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1710248242; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=n/KN7NKEkP4pTfpZis2SsBcJI8chSBYgApj8DLPHUqI=; b=TW8XxziiCu/WGFMXvFuu9TnXd624yWfxTyC25Fr4FY9IY4tZsT1Gd6icN87z+fvKM8GKvK u3DBiT9gqNhp36xGbk4JupIhK/+LKRDYFegP80CU1IoOzAhQR5R1strjL3ZkFN/ssRyF1b cgYIOPTfX/f6C6OVmuqLTYgXWHXjdA0= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-594-PSaNTTrTNe6fZI-wkJoFBQ-1; Tue, 12 Mar 2024 08:57:19 -0400 X-MC-Unique: PSaNTTrTNe6fZI-wkJoFBQ-1 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C5A671801DBC; Tue, 12 Mar 2024 12:57:18 +0000 (UTC) Received: from dceara.remote.csb (unknown [10.39.195.92]) by smtp.corp.redhat.com (Postfix) with ESMTP id 01B0A492BC7; Tue, 12 Mar 2024 12:57:16 +0000 (UTC) From: Dumitru Ceara To: ovs-dev@openvswitch.org Date: Tue, 12 Mar 2024 13:56:56 +0100 Message-Id: <20240312125656.3252402-1-dceara@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Cc: i.maximets@ovn.org Subject: [ovs-dev] [PATCH ovn] controller: Set check_tnl_key for BFD on tunnel ifaces. X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" From: Frode Nordahl The OVS BFD configuration option `check_tnl_key` controls whether OVS should consider the tunnel key before processing BFD control messages. The OVN pipeline design ensures traffic originating from a logical port will have a non-zero tunnel key. Always set `check_tnl_key` to "true" to avoid processing of BFD control messages originating from a logical port. CVE-2024-2182 Signed-off-by: Dumitru Ceara Signed-off-by: Frode Nordahl --- controller/bfd.c | 3 +++ tests/ovn.at | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/controller/bfd.c b/controller/bfd.c index f24bfd0638..22a8c66959 100644 --- a/controller/bfd.c +++ b/controller/bfd.c @@ -235,6 +235,9 @@ bfd_run(const struct ovsrec_interface_table *interface_table, if (mult) { smap_add(&bfd, "mult", mult); } + /* `check_tnl_key` must always be set to "true" to avoid processing of + * BFD control messages originating from a logical port. */ + smap_add(&bfd, "check_tnl_key", "true"); } /* Enable or disable bfd */ diff --git a/tests/ovn.at b/tests/ovn.at index e87df6c8dc..0595f1167e 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -13814,7 +13814,7 @@ for chassis in gw1 hv1 hv2; do echo "checking gw2 -> $chassis" OVS_WAIT_UNTIL([ bfd_cfg=$(ovs-vsctl --bare --columns bfd find Interface name=ovn-$chassis-0) - test "$bfd_cfg" = "enable=true min_rx=2000" + test "$bfd_cfg" = "check_tnl_key=true enable=true min_rx=2000" ]) done ovn-nbctl --wait=hv set NB_Global . options:"bfd-min-tx"=1500 @@ -13822,7 +13822,7 @@ for chassis in gw1 hv1 hv2; do echo "checking gw2 -> $chassis" OVS_WAIT_UNTIL([ bfd_cfg=$(ovs-vsctl --bare --columns bfd find Interface name=ovn-$chassis-0) - test "$bfd_cfg" = "enable=true min_rx=2000 min_tx=1500" + test "$bfd_cfg" = "check_tnl_key=true enable=true min_rx=2000 min_tx=1500" ]) done ovn-nbctl remove NB_Global . options "bfd-min-rx" @@ -13831,7 +13831,7 @@ for chassis in gw1 hv1 hv2; do echo "checking gw2 -> $chassis" OVS_WAIT_UNTIL([ bfd_cfg=$(ovs-vsctl --bare --columns bfd find Interface name=ovn-$chassis-0) - test "$bfd_cfg" = "enable=true min_tx=1500 mult=15" + test "$bfd_cfg" = "check_tnl_key=true enable=true min_tx=1500 mult=15" ]) done