From patchwork Mon Aug 19 05:39:41 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li RongQing X-Patchwork-Id: 1149030 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=openvswitch.org (client-ip=140.211.169.12; helo=mail.linuxfoundation.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=baidu.com Received: from mail.linuxfoundation.org (mail.linuxfoundation.org [140.211.169.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 46Bjb91495z9s7T for ; Mon, 19 Aug 2019 15:46:12 +1000 (AEST) Received: from mail.linux-foundation.org (localhost [127.0.0.1]) by mail.linuxfoundation.org (Postfix) with ESMTP id 7B99B8D7; Mon, 19 Aug 2019 05:46:07 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@mail.linuxfoundation.org Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id B708041C for ; Mon, 19 Aug 2019 05:46:05 +0000 (UTC) X-Greylist: delayed 00:06:21 by SQLgrey-1.7.6 Received: from tc-sys-mailedm01.tc.baidu.com (mx132-tc.baidu.com [61.135.168.132]) by smtp1.linuxfoundation.org (Postfix) with ESMTP id 1B84267F for ; Mon, 19 Aug 2019 05:46:05 +0000 (UTC) Received: from localhost (cp01-cos-dev01.cp01.baidu.com [10.92.119.46]) by tc-sys-mailedm01.tc.baidu.com (Postfix) with ESMTP id CCEBF2040056 for ; Mon, 19 Aug 2019 13:39:41 +0800 (CST) From: Li RongQing To: dev@openvswitch.org Date: Mon, 19 Aug 2019 13:39:41 +0800 Message-Id: <1566193181-5477-1-git-send-email-lirongqing@baidu.com> X-Mailer: git-send-email 1.7.1 X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: [ovs-dev] [PATCH] conntrack: check the result of extract_l3_ipv4/6 X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: ovs-dev-bounces@openvswitch.org Errors-To: ovs-dev-bounces@openvswitch.org the result of extract_l3_ipv4/6 should be checked in reverse_nat_packet when it is false, meaning this packet is wrong, should not do handle it continually Signed-off-by: Li RongQing --- lib/conntrack.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 5f60fea18..c26d5438c 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -695,11 +695,18 @@ reverse_nat_packet(struct dp_packet *pkt, const struct conn *conn) uint16_t orig_l4_ofs = pkt->l4_ofs; if (conn->key.dl_type == htons(ETH_TYPE_IP)) { + bool ok; struct ip_header *nh = dp_packet_l3(pkt); struct icmp_header *icmp = dp_packet_l4(pkt); struct ip_header *inner_l3 = (struct ip_header *) (icmp + 1); - extract_l3_ipv4(&inner_key, inner_l3, tail - ((char *)inner_l3) - pad, + + ok = extract_l3_ipv4(&inner_key, inner_l3, + tail - ((char *)inner_l3) - pad, &inner_l4, false); + if (!ok) { + return; + } + pkt->l3_ofs += (char *) inner_l3 - (char *) nh; pkt->l4_ofs += inner_l4 - (char *) icmp; @@ -715,13 +722,19 @@ reverse_nat_packet(struct dp_packet *pkt, const struct conn *conn) icmp->icmp_csum = 0; icmp->icmp_csum = csum(icmp, tail - (char *) icmp - pad); } else { + bool ok; struct ovs_16aligned_ip6_hdr *nh6 = dp_packet_l3(pkt); struct icmp6_error_header *icmp6 = dp_packet_l4(pkt); struct ovs_16aligned_ip6_hdr *inner_l3_6 = (struct ovs_16aligned_ip6_hdr *) (icmp6 + 1); - extract_l3_ipv6(&inner_key, inner_l3_6, + + ok = extract_l3_ipv6(&inner_key, inner_l3_6, tail - ((char *)inner_l3_6) - pad, &inner_l4); + + if (!ok) { + return; + } pkt->l3_ofs += (char *) inner_l3_6 - (char *) nh6; pkt->l4_ofs += inner_l4 - (char *) icmp6;