On 10/13/26 11:27 PM, Aaron Conole wrote:
> The FTP ALG handling for IPv4 and IPv6 is guarded from overwriting the
> buffer space by checking the headroom + tail-room against the rewrite
> delta. However, when a packet needs to be expanded, only the
> tail-room is actually available. The guard itself allows
> modifications to pass that may otherwise be flagged.
>
> Fix this by only checking that the tail-room has sufficient space to
> handle the packet growth. This is a bit different as we no longer
> check the delta, but just the actual expansion room available. This
> check is a bit more conservative, so there could be an edge-case
> packet that used to pass through the checks but no longer
> would.
>
> The FTP ALG unit tests are updated to correct a comment about the
> guard design, and test for the new condition.
>
> Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.")
> Reported-by: VinÃcius Rodrigues <[email protected]>
> Assisted-by: Claude Sonnet 4.5, Claude Opus
> Signed-off-by: Aaron Conole <[email protected]>
> ---
> v1->v2: Fix splats related to the test suite
> v2->v3: Fix the test suite after review from Ilya
> NOTE: We need to add Vinicius to the AUTHORS file on commit,
> because there is an email domain that CloudFlare complains
> about.
>
> lib/conntrack.c | 20 ++++----
> tests/library.at | 4 ++
> tests/test-conntrack.c | 113 +++++++++++++++++++++++++++++++++++++++--
> 3 files changed, 124 insertions(+), 13 deletions(-)
Recheck-request: github-robot
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
