Messages in this thread | | | From | Eelco Chaudron <> | Subject | Re: [ovs-dev] [PATCH net] net: openvswitch: fix overwriting ct original tuple for ICMPv6 | Date | Fri, 10 May 2024 08:25:24 +0200 |
| |
On 9 May 2024, at 11:38, Ilya Maximets wrote:
> OVS_PACKET_CMD_EXECUTE has 3 main attributes: > - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. > - OVS_PACKET_ATTR_PACKET - Binary packet content. > - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. > > OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure > with the metadata like conntrack state, input port, recirculation id, > etc. Then the packet itself gets parsed to populate the rest of the > keys from the packet headers. > > Whenever the packet parsing code starts parsing the ICMPv6 header, it > first zeroes out fields in the key corresponding to Neighbor Discovery > information even if it is not an ND packet. > > It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares > the space between 'nd' and 'ct_orig' that holds the original tuple > conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. > > ND packets should not normally have conntrack state, so it's fine to > share the space, but normal ICMPv6 Echo packets or maybe other types of > ICMPv6 can have the state attached and it should not be overwritten. > > The issue results in all but the last 4 bytes of the destination > address being wiped from the original conntrack tuple leading to > incorrect packet matching and potentially executing wrong actions > in case this packet recirculates within the datapath or goes back > to userspace. > > ND fields should not be accessed in non-ND packets, so not clearing > them should be fine. Executing memset() only for actual ND packets to > avoid the issue. > > Initializing the whole thing before parsing is needed because ND packet > may not contain all the options. > > The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't > affect packets entering OVS datapath from network interfaces, because > in this case CT metadata is populated from skb after the packet is > already parsed. > > Fixes: 9dd7f8907c37 ("openvswitch: Add original direction conntrack tuple to sw_flow_key.") > Reported-by: Antonin Bas <antonin.bas@broadcom.com> > Closes: https://github.com/openvswitch/ovs-issues/issues/327 > Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
This patch looks good to me.
Acked-by: Eelco Chaudron <echaudro@redhat.com>
> --- > > Note: I'm working on a selftest for this issue, but it requires some > ground work first to add support for OVS_PACKET_CMD_EXECUTE into > opnevswitch selftests as well as parsing of ct tuples. So it is going > to be a separate patch set. > > net/openvswitch/flow.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c > index 33b21a0c0548..8a848ce72e29 100644 > --- a/net/openvswitch/flow.c > +++ b/net/openvswitch/flow.c > @@ -561,7 +561,6 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, > */ > key->tp.src = htons(icmp->icmp6_type); > key->tp.dst = htons(icmp->icmp6_code); > - memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); > > if (icmp->icmp6_code == 0 && > (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION || > @@ -570,6 +569,8 @@ static int parse_icmpv6(struct sk_buff *skb, struct sw_flow_key *key, > struct nd_msg *nd; > int offset; > > + memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd)); > + > /* In order to process neighbor discovery options, we need the > * entire packet. > */ > -- > 2.44.0 > > _______________________________________________ > dev mailing list > dev@openvswitch.org > https://mail.openvswitch.org/mailman/listinfo/ovs-dev
| |