Joas Antonio dos Santos via B4 Relay <[email protected]> writes:
> From: Joas Antonio dos Santos <[email protected]> > > get_ipv6_ext_hdrs() walks the IPv6 extension header chain to fill > key->ipv6.exthdrs, but advances to the next header with ipv6_optlen() > whatever the current header is. That is only right for Hop-by-Hop, > Destination Options and Routing headers: > > - an Authentication Header is ((hdrlen + 2) << 2) bytes long > (ipv6_authlen()), so with hdrlen = 4 the walk skips 40 bytes instead > of 24 and reads the next "header" from the ICV and payload; > > - a Fragment header is always 8 bytes, and the byte read as hdrlen is > its Reserved field, which the sender controls and receivers ignore, > so a non-zero value makes the walk skip up to 2048 bytes and miss > the headers that follow; > > - in a non-first fragment nothing after the Fragment header is a > header at all, it is the middle of the fragmentable part, yet the > walk keeps parsing it as an extension header chain. > > In all cases the OFPIEH12_* bits stored in key->ipv6.exthdrs depend on > bytes chosen by the sender rather than on the headers that are actually > present: payload bytes that look like another AH or a Hop-by-Hop header > add OFPIEH12_UNREP/OFPIEH12_UNSEQ, and real headers after a Fragment > header can go unreported. Flows that match on OVS_KEY_ATTR_IPV6_EXTHDRS > then classify such packets wrongly. There is no memory safety issue, > skb_header_pointer() bounds every read. > > Advance by sizeof(struct frag_hdr) for Fragment headers and by > ipv6_authlen() for AH, and stop at the Fragment header if its offset is > non-zero, as ipv6_find_hdr() does. > > Fixes: 28a3f0601727 ("net: openvswitch: IPv6: Add IPv6 extension header > support") > Link: > https://lore.kernel.org/all/[email protected]/ > Cc: [email protected] > Signed-off-by: Joas Antonio dos Santos <[email protected]> > --- Reviewed-by: Aaron Conole <[email protected]> _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
