From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Wang, Yinan" Subject: Re: [PATCH v2] gro: add missing invalid packet checks Date: Tue, 15 Jan 2019 05:05:28 +0000 Message-ID: References: <1546927725-68831-1-git-send-email-jiayu.hu@intel.com> <1547132768-2384-1-git-send-email-jiayu.hu@intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Cc: "Ananyev, Konstantin" , "thomas@monjalon.net" , "Hu, Jiayu" , "stable@dpdk.org" To: "Hu, Jiayu" , "dev@dpdk.org" Return-path: In-Reply-To: <1547132768-2384-1-git-send-email-jiayu.hu@intel.com> Content-Language: en-US List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Tested-by: Yinan Wang Best Wishes, Yinan -----Original Message----- From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Jiayu Hu Sent: 2019=1B$BG/=1B(B1=1B$B7n=1B(B10=1B$BF|=1B(B 23:06 To: dev@dpdk.org Cc: Ananyev, Konstantin ; thomas@monjalon.net= ; Hu, Jiayu ; stable@dpdk.org Subject: [dpdk-dev] [PATCH v2] gro: add missing invalid packet checks Currently, GRO library doesn't check if input packets have invalid headers.= The packets with invalid headers will also be processed by GRO. However, GRO shouldn't process invalid packets. This patch adds missing inv= alid packet checks. Fixes: 0d2cbe59b719 ("lib/gro: support TCP/IPv4") Fixes: 9e0b9d2ec0f4 ("gro: support VxLAN GRO") Cc: stable@dpdk.org Signed-off-by: Jiayu Hu --- changes in v2: - fix VxLAN header length check bug for VxLAN GRO; - fix ethernet header length check bug; - use sizeof() and macro to present valid header length; - add VLAN related comments since GRO cannot process VLAN tagged packets. lib/librte_gro/gro_tcp4.c | 12 ++++++++++++ lib/librte_gro/gro_tcp4.h | 10 ++++++++++ lib/librte_gro/gro_vxlan_tcp4.c | 15 +++++++++++++++ 3 files changed, 37 insertions(+) diff --git a/lib/librte_gro/gro_tcp4.c b/lib/librte_gro/gro_tcp4.c index 2f= e9aab..48076e0 100644 --- a/lib/librte_gro/gro_tcp4.c +++ b/lib/librte_gro/gro_tcp4.c @@ -208,6 +208,18 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt, int cmp; uint8_t find; =20 + /* + * Don't process the packet whose Ethernet, IPv4 and TCP header + * lengths are invalid. + * + * In addition, GRO doesn't process the packet that is VLAN + * tagged or whose the IPv4 header contains Options. + */ + if (unlikely(ILLEGAL_ETHER_HDRLEN(pkt->l2_len) || + ILLEGAL_IPV4_HDRLEN(pkt->l3_len) || + ILLEGAL_TCP_HDRLEN(pkt->l4_len))) + return -1; + eth_hdr =3D rte_pktmbuf_mtod(pkt, struct ether_hdr *); ipv4_hdr =3D (struct ipv4_hdr *)((char *)eth_hdr + pkt->l2_len); tcp_hdr =3D (struct tcp_hdr *)((char *)ipv4_hdr + pkt->l3_len); diff --gi= t a/lib/librte_gro/gro_tcp4.h b/lib/librte_gro/gro_tcp4.h index 6bb30cd..65= bcae8 100644 --- a/lib/librte_gro/gro_tcp4.h +++ b/lib/librte_gro/gro_tcp4.h @@ -17,6 +17,16 @@ */ #define MAX_IPV4_PKT_LENGTH UINT16_MAX =20 +/* The maximum TCP header length */ +#define TCP_MAX_HLEN 60 + +#define ILLEGAL_ETHER_HDRLEN(len) ((len) !=3D ETHER_HDR_LEN) #define=20 +ILLEGAL_ETHER_VXLAN_HDRLEN(len) \ + ((len) !=3D (ETHER_VXLAN_HLEN + ETHER_HDR_LEN)) #define=20 +ILLEGAL_IPV4_HDRLEN(len) ((len) !=3D sizeof(struct ipv4_hdr)) #define=20 +ILLEGAL_TCP_HDRLEN(len) \ + (((len) < sizeof(struct tcp_hdr)) || ((len) > TCP_MAX_HLEN)) + /* Header fields representing a TCP/IPv4 flow */ struct tcp4_flow_key { struct ether_addr eth_saddr; diff --git a/lib/librte_gro/gro_vxlan_tcp4.c b/lib/librte_gro/gro_vxlan_tcp= 4.c index 955ae4b..72d63bc 100644 --- a/lib/librte_gro/gro_vxlan_tcp4.c +++ b/lib/librte_gro/gro_vxlan_tcp4.c @@ -306,6 +306,21 @@ gro_vxlan_tcp4_reassemble(struct rte_mbuf *pkt, uint16_t hdr_len; uint8_t find; =20 + /* + * Don't process the packet whose outer Ethernet, outer IPv4, + * VxLAN header, inner Ethernet, inner IPv4 and inner TCP + * header lengths are invalid. + * + * In addition, GRO doesn't process the packet that is VLAN + * tagged or whose IPv4 header contains Options. + */ + if (unlikely(ILLEGAL_ETHER_HDRLEN(pkt->outer_l2_len) || + ILLEGAL_IPV4_HDRLEN(pkt->outer_l3_len) || + ILLEGAL_ETHER_VXLAN_HDRLEN(pkt->l2_len) || + ILLEGAL_IPV4_HDRLEN(pkt->l3_len) || + ILLEGAL_TCP_HDRLEN(pkt->l4_len))) + return -1; + outer_eth_hdr =3D rte_pktmbuf_mtod(pkt, struct ether_hdr *); outer_ipv4_hdr =3D (struct ipv4_hdr *)((char *)outer_eth_hdr + pkt->outer_l2_len); -- 2.7.4