| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20160318232503.14955.51273.stgit@localhost.localdomain> Date: Fri, 18 Mar 2016 16:25:03 -0700 From: Alexander Duyck <aduyck@...antis.com> To: ecree@...arflare.com, netdev@...r.kernel.org, davem@...emloft.net, alexander.duyck@...il.com, tom@...bertland.com Subject: [RFC PATCH 4/9] vxlan: Enforce IP ID verification on outer headers This change enforces the IP ID verification on outer headers. As a result if the DF flag is not set on the outer header we will force the flow to be flushed in the event that the IP ID is out of sequence with the existing flow. Signed-off-by: Alexander Duyck <aduyck@...antis.com> --- drivers/net/vxlan.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c index 800106a7246c..d6838a30e772 100644 --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -601,6 +601,20 @@ static struct sk_buff **vxlan_gro_receive(struct sk_buff **head, NAPI_GRO_CB(p)->same_flow = 0; continue; } + + /* Include the IP ID check from the outer IP hdr */ + if (!NAPI_GRO_CB(p)->flush_id) + continue; + + /* If flush_id is non-zero and rfc6864 is enabled for + * the new frame the only possibility is that we are + * incrementing so we can xor by count to cancel out + * the one acceptable value. + */ + NAPI_GRO_CB(p)->flush |= NAPI_GRO_CB(skb)->rfc6864 ? + NAPI_GRO_CB(p)->flush_id ^ + NAPI_GRO_CB(p)->count : + NAPI_GRO_CB(p)->flush_id; } pp = eth_gro_receive(head, skb);
Powered by blists - more mailing lists