netdev - Re: [PATCH v3 2/2] openvswitch: Remove padding from packet before L3+ conntrack processing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Jan 2018 21:40:25 -0800
From:   Pravin Shelar <pshelar@....org>
To:     Ed Swierk <eswierk@...portsystems.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        ovs-dev <ovs-dev@...nvswitch.org>
Subject: Re: [PATCH v3 2/2] openvswitch: Remove padding from packet before L3+
 conntrack processing

On Mon, Jan 22, 2018 at 6:42 PM, Ed Swierk <eswierk@...portsystems.com> wrote:
> In the OVS conntrack receive path, ovs_ct_execute() pulls the skb to
> the L3 header but does not trim it to the L3 length before calling
> nf_conntrack_in(NF_INET_PRE_ROUTING). When nf_conntrack_proto_tcp
> encounters a packet with lower-layer padding, nf_checksum() fails and
> logs "nf_ct_tcp: bad TCP checksum". While extra zero bytes don't
> affect the checksum, the length in the IP pseudoheader does. That
> length is based on skb->len, and without trimming, it doesn't match
> the length the sender used when computing the checksum.
>
> In ovs_ct_execute(), call skb_network_trim() before any L3+ conntrack
> processing.
>
> Signed-off-by: Ed Swierk <eswierk@...portsystems.com>

Acked-by: Pravin B Shelar <pshelar@....org>

Thanks.