mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-09-01 06:45:17 +00:00
Code Issues Releases Wiki Activity

datapath-windows: Add validations for IP_HEADER_LEN

Browse Source 
Adds validations in OvsGetIp() to make sure the IHL is
within valid bounds. If IHL is invalid, then the packet
is dropped by the callers of this function.

Signed-off-by: Shashank Ram <rams@vmware.com>
Acked-by: Sairam Venugopal <vsairam@vmware.com>
Acked-by: Nithin Raju <nithin@vmware.com>
Signed-off-by: Gurucharan Shetty <guru@ovn.org>
This commit is contained in:
Shashank Ram
2017-06-15 15:15:47 -07:00
committed by Gurucharan Shetty
parent 6c6204b678
commit 9d71ade0cf
6 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
datapath-windows/ovsext/Flow.c
View File

@@ -2141,6 +2141,9 @@ OvsExtractLayers(const NET_BUFFER_LIST *packet,
} }
} }
} }
} else {
/* Invalid network header */
return NDIS_STATUS_INVALID_PACKET;
} }
} else if (dlType == htons(ETH_TYPE_IPV6)) { } else if (dlType == htons(ETH_TYPE_IPV6)) {
NDIS_STATUS status; NDIS_STATUS status;
@@ -2360,8 +2363,10 @@ OvsExtractFlow(const NET_BUFFER_LIST *packet,
} }
} }
} else { } else {
/* Invalid network header */
((UINT64 *)ipKey)[0] = 0; ((UINT64 *)ipKey)[0] = 0;
((UINT64 *)ipKey)[1] = 0; ((UINT64 *)ipKey)[1] = 0;
return NDIS_STATUS_INVALID_PACKET;
} }
} else if (flow->l2.dlType == htons(ETH_TYPE_IPV6)) { } else if (flow->l2.dlType == htons(ETH_TYPE_IPV6)) {
NDIS_STATUS status; NDIS_STATUS status;

3
datapath-windows/ovsext/Offload.c
View File

@@ -563,6 +563,9 @@ OvsValidateIPChecksum(PNET_BUFFER_LIST curNbl,
if (checksum != hdrChecksum) { if (checksum != hdrChecksum) {
return NDIS_STATUS_FAILURE; return NDIS_STATUS_FAILURE;
} }
} else {
/* Invalid network header */
return NDIS_STATUS_FAILURE;
} }
} }
return NDIS_STATUS_SUCCESS; return NDIS_STATUS_SUCCESS;

9
datapath-windows/ovsext/PacketParser.h
View File

@@ -17,6 +17,8 @@
#ifndef __PACKET_PARSER_H_ #ifndef __PACKET_PARSER_H_
#define __PACKET_PARSER_H_ 1 #define __PACKET_PARSER_H_ 1
#define MIN_IPV4_HLEN 20
#include "precomp.h" #include "precomp.h"
#include "NetProto.h" #include "NetProto.h"
@@ -107,7 +109,12 @@ OvsGetIp(const NET_BUFFER_LIST *packet,
const IPHdr *ip = OvsGetPacketBytes(packet, sizeof *ip, ofs, storage); const IPHdr *ip = OvsGetPacketBytes(packet, sizeof *ip, ofs, storage);
if (ip) { if (ip) {
int ipLen = ip->ihl * 4; int ipLen = ip->ihl * 4;
if (ipLen >= sizeof *ip && OvsPacketLenNBL(packet) >= ofs + ipLen) { if (ipLen < MIN_IPV4_HLEN ||
ipLen > MAX_IPV4_HLEN ||
OvsPacketLenNBL(packet) < ofs + ipLen) {
/* IP header is invalid, flag it */
return NULL;
} else {
return ip; return ip;
} }
} }

2
datapath-windows/ovsext/Stt.c
View File

@@ -1019,7 +1019,7 @@ OvsDecapStt(POVS_SWITCH_CONTEXT switchContext,
innerIpHdr->check = IPChecksum((UINT8 *)innerIpHdr, innerIpHdr->check = IPChecksum((UINT8 *)innerIpHdr,
innerIpHdr->ihl * 4, 0); innerIpHdr->ihl * 4, 0);
} else { } else {
status = NDIS_STATUS_RESOURCES; status = NDIS_STATUS_INVALID_PACKET;
goto dropNbl; goto dropNbl;
} }
} else if (layers.isIPv6) { } else if (layers.isIPv6) {

5
datapath-windows/ovsext/User.c
View File

@@ -465,6 +465,11 @@ OvsExecuteDpIoctl(OvsPacketExecute *execute)
ndisStatus = OvsExtractFlow(pNbl, execute->inPort, &key, &layers, ndisStatus = OvsExtractFlow(pNbl, execute->inPort, &key, &layers,
tempTunKey.tunKey.dst == 0 ? NULL : &tempTunKey.tunKey); tempTunKey.tunKey.dst == 0 ? NULL : &tempTunKey.tunKey);
if (ndisStatus != NDIS_STATUS_SUCCESS) {
/* Invalid network header */
goto dropit;
}
ctx = (POVS_BUFFER_CONTEXT)NET_BUFFER_LIST_CONTEXT_DATA_START(pNbl); ctx = (POVS_BUFFER_CONTEXT)NET_BUFFER_LIST_CONTEXT_DATA_START(pNbl);
ctx->mru = execute->mru; ctx->mru = execute->mru;

3
datapath-windows/ovsext/Vxlan.c
View File

@@ -489,7 +489,8 @@ OvsSlowPathDecapVxlan(const PNET_BUFFER_LIST packet,
if (nh) { if (nh) {
layers.l4Offset = layers.l3Offset + nh->ihl * 4; layers.l4Offset = layers.l3Offset + nh->ihl * 4;
} else { } else {
break; status = NDIS_STATUS_INVALID_PACKET;
break;
} }
/* make sure it's a VXLAN packet */ /* make sure it's a VXLAN packet */