linux/net/openvswitch
Ed Swierk 9382fe71c0 openvswitch: Remove padding from packet before L3+ conntrack processing
IPv4 and IPv6 packets may arrive with lower-layer padding that is not
included in the L3 length. For example, a short IPv4 packet may have
up to 6 bytes of padding following the IP payload when received on an
Ethernet device with a minimum packet length of 64 bytes.

Higher-layer processing functions in netfilter (e.g. nf_ip_checksum(),
and help() in nf_conntrack_ftp) assume skb->len reflects the length of
the L3 header and payload, rather than referring back to
ip_hdr->tot_len or ipv6_hdr->payload_len, and get confused by
lower-layer padding.

In the normal IPv4 receive path, ip_rcv() trims the packet to
ip_hdr->tot_len before invoking netfilter hooks. In the IPv6 receive
path, ip6_rcv() does the same using ipv6_hdr->payload_len. Similarly
in the br_netfilter receive path, br_validate_ipv4() and
br_validate_ipv6() trim the packet to the L3 length before invoking
netfilter hooks.

Currently in the OVS conntrack receive path, ovs_ct_execute() pulls
the skb to the L3 header but does not trim it to the L3 length before
calling nf_conntrack_in(NF_INET_PRE_ROUTING). When
nf_conntrack_proto_tcp encounters a packet with lower-layer padding,
nf_ip_checksum() fails causing a "nf_ct_tcp: bad TCP checksum" log
message. While extra zero bytes don't affect the checksum, the length
in the IP pseudoheader does. That length is based on skb->len, and
without trimming, it doesn't match the length the sender used when
computing the checksum.

In ovs_ct_execute(), trim the skb to the L3 length before higher-layer
processing.

Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-01 09:46:22 -05:00
..
Kconfig openvswitch: enable NSH support 2017-11-08 16:12:33 +09:00
Makefile openvswitch: Add meter infrastructure 2017-11-13 10:37:07 +09:00
actions.c openvswitch: Add meter action support 2017-11-13 10:37:07 +09:00
conntrack.c openvswitch: Remove padding from packet before L3+ conntrack processing 2018-02-01 09:46:22 -05:00
conntrack.h openvswitch: add ct_clear action 2017-10-10 16:38:34 -07:00
datapath.c net: openvswitch: datapath: fix data type in queue_gso_packets 2017-11-27 02:15:33 +09:00
datapath.h openvswitch: Add meter action support 2017-11-13 10:37:07 +09:00
dp_notify.c openvswitch: reliable interface indentification in port dumps 2017-11-05 21:49:17 +09:00
flow.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-12-22 11:16:31 -05:00
flow.h openvswitch: enable NSH support 2017-11-08 16:12:33 +09:00
flow_netlink.c openvswitch: add erspan version I and II support 2018-01-25 21:39:43 -05:00
flow_netlink.h openvswitch: enable NSH support 2017-11-08 16:12:33 +09:00
flow_table.c
flow_table.h
meter.c openvswitch: meter: Use 64-bit arithmetic instead of 32-bit 2018-01-31 10:26:30 -05:00
meter.h openvswitch: Add meter infrastructure 2017-11-13 10:37:07 +09:00
vport-geneve.c
vport-gre.c
vport-internal_dev.c net: ovs: remove unused hardirq.h 2018-01-08 20:59:25 -05:00
vport-internal_dev.h
vport-netdev.c net: Add extack to upper device linking 2017-10-04 21:39:33 -07:00
vport-netdev.h
vport-vxlan.c
vport.c
vport.h