On Tue, Oct 13, 2026 at 5:30 PM Aaron Conole <[email protected]> wrote:
> The FTP ALG handling for IPv4 and IPv6 is guarded from overwriting the
> buffer space by checking the headroom + tail-room against the rewrite
> delta. However, when a packet needs to be expanded, only the
> tail-room is actually available. The guard itself allows
> modifications to pass that may otherwise be flagged.
>
> Fix this by only checking that the tail-room has sufficient space to
> handle the packet growth. This is a bit different as we no longer
> check the delta, but just the actual expansion room available. This
> check is a bit more conservative, so there could be an edge-case
> packet that used to pass through the checks but no longer
> would.
>
> The FTP ALG unit tests are updated to correct a comment about the
> guard design, and test for the new condition.
>
> Fixes: bd5e81a0e596 ("Userspace Datapath: Add ALG infra and FTP.")
> Reported-by: Vinícius Rodrigues <[email protected]>
> Assisted-by: Claude Sonnet 4.5, Claude Opus
> Signed-off-by: Aaron Conole <[email protected]>
> ---
>
The new test seems to function better than the previous version.
Acked-by: Mike Pattrick <[email protected]>
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
