netdev - Re: [PATCH net v2 1/2] net: dst_metadata: fix IP_DF bit not extracted from tunnel headers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aMEYjvSNvxfD7iJz@shredder>
Date: Wed, 10 Sep 2025 09:19:58 +0300
From: Ido Schimmel <idosch@...sch.org>
To: Ilya Maximets <i.maximets@....org>
Cc: netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>, linux-kernel@...r.kernel.org,
	linux-kselftest@...r.kernel.org, dev@...nvswitch.org,
	Eelco Chaudron <echaudro@...hat.com>,
	Aaron Conole <aconole@...hat.com>, Shuah Khan <shuah@...nel.org>,
	Jamal Hadi Salim <jhs@...atatu.com>,
	Davide Caratti <dcaratti@...hat.com>
Subject: Re: [PATCH net v2 1/2] net: dst_metadata: fix IP_DF bit not
 extracted from tunnel headers

On Tue, Sep 09, 2025 at 06:54:15PM +0200, Ilya Maximets wrote:
> Both OVS and TC flower allow extracting and matching on the DF bit of
> the outer IP header via OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT in the
> OVS_KEY_ATTR_TUNNEL and TCA_FLOWER_KEY_FLAGS_TUNNEL_DONT_FRAGMENT in
> the TCA_FLOWER_KEY_ENC_FLAGS respectively.  Flow dissector extracts
> this information as FLOW_DIS_F_TUNNEL_DONT_FRAGMENT from the tunnel
> info key.
> 
> However, the IP_TUNNEL_DONT_FRAGMENT_BIT in the tunnel key is never
> actually set, because the tunneling code doesn't actually extract it
> from the IP header.  OAM and CRIT_OPT are extracted by the tunnel
> implementation code, same code also sets the KEY flag, if present.
> UDP tunnel core takes care of setting the CSUM flag if the checksum
> is present in the UDP header, but the DONT_FRAGMENT is not handled at
> any layer.
> 
> Fix that by checking the bit and setting the corresponding flag while
> populating the tunnel info in the IP layer where it belongs.
> 
> Not using __assign_bit as we don't really need to clear the bit in a
> just initialized field.  It also doesn't seem like using __assign_bit
> will make the code look better.
> 
> Clearly, users didn't rely on this functionality for anything very
> important until now.  The reason why this doesn't break OVS logic is
> that it only matches on what kernel previously parsed out and if kernel
> consistently reports this bit as zero, OVS will only match on it to be
> zero, which sort of works.  But it is still a bug that the uAPI reports
> and allows matching on the field that is not actually checked in the
> packet.  And this is causing misleading -df reporting in OVS datapath
> flows, while the tunnel traffic actually has the bit set in most cases.
> 
> This may also cause issues if a hardware properly implements support
> for tunnel flag matching as it will disagree with the implementation
> in a software path of TC flower.
> 
> Fixes: 7d5437c709de ("openvswitch: Add tunneling interface.")
> Fixes: 1d17568e74de ("net/sched: cls_flower: add support for matching tunnel control flags")
> Signed-off-by: Ilya Maximets <i.maximets@....org>

Reviewed-by: Ido Schimmel <idosch@...dia.com>