netdev - Re: [net-next PATCH 2/5] flow_dissector: Fix fragment handling for header length computation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 24 Feb 2016 10:14:29 -0800
From:	Tom Herbert <tom@...bertland.com>
To:	Alexander Duyck <aduyck@...antis.com>
Cc:	Linux Kernel Network Developers <netdev@...r.kernel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Alexander Duyck <alexander.duyck@...il.com>
Subject: Re: [net-next PATCH 2/5] flow_dissector: Fix fragment handling for
 header length computation

On Wed, Feb 24, 2016 at 9:29 AM, Alexander Duyck <aduyck@...antis.com> wrote:
> It turns out that for IPv4 we were reporting the ip_proto of the fragment,
> and for IPv6 we were not.  This patch updates that behavior so that we
> always report the IP protocol of the fragment.  In addition it takes the
> steps of updating the payload offset code so that we will determine the
> start of the payload not including the L4 header for any fragment after the
> first.
>
> Signed-off-by: Alexander Duyck <aduyck@...antis.com>

Acked-by: Tom Herbert <tom@...bertland.com>

> ---
>  net/core/flow_dissector.c |   10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
> index 1f88f8280280..8bd745f72734 100644
> --- a/net/core/flow_dissector.c
> +++ b/net/core/flow_dissector.c
> @@ -448,13 +448,12 @@ ip_proto_again:
>                 key_control->flags |= FLOW_DIS_IS_FRAGMENT;
>
>                 nhoff += sizeof(_fh);
> +               ip_proto = fh->nexthdr;
>
>                 if (!(fh->frag_off & htons(IP6_OFFSET))) {
>                         key_control->flags |= FLOW_DIS_FIRST_FRAG;
> -                       if (flags & FLOW_DISSECTOR_F_PARSE_1ST_FRAG) {
> -                               ip_proto = fh->nexthdr;
> +                       if (flags & FLOW_DISSECTOR_F_PARSE_1ST_FRAG)
>                                 goto ip_proto_again;
> -                       }
>                 }
>                 goto out_good;
>         }
> @@ -741,6 +740,11 @@ u32 __skb_get_poff(const struct sk_buff *skb, void *data,
>  {
>         u32 poff = keys->control.thoff;
>
> +       /* skip L4 headers for fragments after the first */
> +       if ((keys->control.flags & FLOW_DIS_IS_FRAGMENT) &&
> +           !(keys->control.flags & FLOW_DIS_FIRST_FRAG))
> +               return poff;
> +
>         switch (keys->basic.ip_proto) {
>         case IPPROTO_TCP: {
>                 /* access doff as u8 to avoid unaligned access */
>