On Mon, Aug 31, 2026 at 2:12 PM Aaron Conole via dev <
[email protected]> wrote:
> The FTP ALG handling for IPv4 and IPv6 is guarded from overwriting the
> buffer space by checking the headroom + tailroom against the rewrite
> delta. However, when a packet needs to be expanded, only the tailroom
> is actually available. The guard itself allows modifications to pass
> that may otherwise be flagged.
>
> Fix this by only checking that the tailroom has sufficient space to
> handle the packet growth. This is a bit different as we no longer
> check the delta, but just the actual expansion room available. This
> check is a bit more conservative, so there could be an edge-case
> packet that used to pass through the checks but no longer
> would.
>
> The FTP ALG unit tests are updated to correct a comment about the
> guard design, and test for the new condition.
>
> Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.")
> Reported-by: Vinícius Rodrigues <[email protected]>
> Assisted-by: Claude Sonnet 4.5
> Signed-off-by: Aaron Conole <[email protected]>
> ---
Looks good to me.
Acked-by: Mike Pattrick <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
