netdev - Re: [PATCH net-next v11 08/23] ovpn: implement basic TX path (UDP)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <387d3fc5-9ff6-4a8e-b766-5e30d0aef4a4@openvpn.net>
Date: Fri, 15 Nov 2024 15:39:36 +0100
From: Antonio Quartulli <antonio@...nvpn.net>
To: Sergey Ryazanov <ryazanov.s.a@...il.com>
Cc: Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>, Donald Hunter <donald.hunter@...il.com>,
 Shuah Khan <shuah@...nel.org>, sd@...asysnail.net,
 Andrew Lunn <andrew@...n.ch>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org
Subject: Re: [PATCH net-next v11 08/23] ovpn: implement basic TX path (UDP)

On 11/11/2024 00:54, Sergey Ryazanov wrote:
> Another one forgotten question, sorry about this. Please find the 
> question inlined.
> 
> On 29.10.2024 12:47, Antonio Quartulli wrote:
>>   /* Send user data to the network
>>    */
>>   netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev)
>>   {
>> +    struct ovpn_struct *ovpn = netdev_priv(dev);
>> +    struct sk_buff *segments, *curr, *next;
>> +    struct sk_buff_head skb_list;
>> +    __be16 proto;
>> +    int ret;
>> +
>> +    /* reset netfilter state */
>> +    nf_reset_ct(skb);
>> +
>> +    /* verify IP header size in network packet */
>> +    proto = ovpn_ip_check_protocol(skb);
>> +    if (unlikely(!proto || skb->protocol != proto)) {
>> +        net_err_ratelimited("%s: dropping malformed payload packet\n",
>> +                    dev->name);
>> +        dev_core_stats_tx_dropped_inc(ovpn->dev);
>> +        goto drop;
>> +    }
> 
> The above check implies that kernel can feed a network device with skb- 
>  >protocol value mismatches actual skb content. Can you share any 
> example of such case?
> 
> If you just want to be sure that the user packet is either IPv4 or IPv6 
> then it can be done like this and without error messages:
> 
> /* Support only IPv4 or IPv6 traffic transporting */
> if (unlikely(skb->protocol == ETH_P_IP || skb->protocol == ETH_P_IPV6))
>      goto drop;

It look good, but I will still increase the drop counter, because 
something entered the interface and we are trashing it.

Why not printing a message? The interface is not Ethernet based, so I 
think we should not expect anything else other than v4 or v6, no?

Thanks.

Regards,


-- 
Antonio Quartulli
OpenVPN Inc.