linux-kernel - ipv4: Constrain UFO fragment sizes to multiples of 8 bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 6 Jun 2016 20:24:05 +0000
From:	Steven Caron <steven.caron@...band.com>
To:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC:	Steven Caron <steven.caron@...band.com>
Subject: ipv4: Constrain UFO fragment sizes to multiples of 8 bytes

Back in 2011, Bill Sommerfeld submitted an update to prevent ip_append_data to create malformed packets:
 Commit: d9be4f7a6f5a8da3133b832eca41c3591420b1ca

Now we're finding that we need to apply the same logic to ip_append_page  to get nfs to work with udp when UFO is enabled:

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 124bf0a..21ec54e 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1239,7 +1239,7 @@ ssize_t   ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                if (skb->ip_summed != CHECKSUM_PARTIAL)
                        return -EOPNOTSUPP;

-               skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+               skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
        }
        cork->length += size;

We're wondering if this is something that was missed by that initial update of if there is a reason for ip_append_page to behave differently.

We realize that there might not be a lot of people who care about running NFS over UDP, but the issue is still reproducible in the latest kernel.

I include some additional info in case anyone is interested in reproducing with their own setup.

Using two VMs connected with a bridge, one using e1000, the other virtio.
Test done using FInnix 111 (kernel 4.0) as the guest.

# On each VM export which allows NFSv3
mount -t tmpfs tmps /export
vi /etc/exports
/export *(rw,no_subtree_check,fsid=0,insecure) # insecure to allow NFSv3
/etc/init.d/rpcbind start
/etc/init.d/nfs-kernel-server start

# On each VM mount each other exported as UDP 
mkdir /mnt/import
mount 169.254.208.5:/export /mnt/import -o vers=3,udp,rsize=16394,wsize=16384,soft,nolock # soft to avoid permanent hang

# Using common MTU of 1500 on both VMs
ifconfig eth0 mtu 1500

# On the one with UFO=on (virtio):
dd if=/dev/zero count=1 bs=16384 of=/mnt/import/test
# Work as expected

# On the one with UFO=on (virtio)
dd if=/dev/zero count=1 bs=16384 of=/export/test
# On the one with UFO=off (e1000)
dd if=/mnt/import/test count=1 bs=16384 of=/dev/null
# Work as expected


# Using non-standard MTU of 1496 of both VMs
ifconfig eth0 mtu 1496

# On the one with UFO=on (virtio)
dd if=/dev/zero count=1 bs=16384 of=/mnt/import/test
# get Input/output error

# On the one with UFO=on (virtio)
dd if=/dev/zero count=1 bs=16384 of=/export/test
# On the one with UFO=off (e1000)
dd if=/mnt/import/test count=1 bs=1496 of=/dev/null
# get Input/output error

Regards,

Steven Caron 
Designer, GENWare 
500 Palladium Dr. Suite 2100| Ottawa ON, K2V 1C2  
office: +1.343.883.2345  |  steven.caron.genband.com