From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id CFC4D6833; Tue, 15 Jan 2019 06:05:32 +0100 (CET) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga101.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 Jan 2019 21:05:31 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,480,1539673200"; d="scan'208";a="311875906" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by fmsmga005.fm.intel.com with ESMTP; 14 Jan 2019 21:05:31 -0800 Received: from fmsmsx126.amr.corp.intel.com (10.18.125.43) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 14 Jan 2019 21:05:31 -0800 Received: from shsmsx152.ccr.corp.intel.com (10.239.6.52) by FMSMSX126.amr.corp.intel.com (10.18.125.43) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 14 Jan 2019 21:05:30 -0800 Received: from shsmsx103.ccr.corp.intel.com ([169.254.4.150]) by SHSMSX152.ccr.corp.intel.com ([169.254.6.44]) with mapi id 14.03.0415.000; Tue, 15 Jan 2019 13:05:29 +0800 From: "Wang, Yinan" To: "Hu, Jiayu" , "dev@dpdk.org" CC: "Ananyev, Konstantin" , "thomas@monjalon.net" , "Hu, Jiayu" , "stable@dpdk.org" Thread-Topic: [dpdk-dev] [PATCH v2] gro: add missing invalid packet checks Thread-Index: AQHUqPYf0omMSnuXWkaTr6A4+P2UiKWvkjxQ Date: Tue, 15 Jan 2019 05:05:28 +0000 Message-ID: References: <1546927725-68831-1-git-send-email-jiayu.hu@intel.com> <1547132768-2384-1-git-send-email-jiayu.hu@intel.com> In-Reply-To: <1547132768-2384-1-git-send-email-jiayu.hu@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiMDYxMjJmZTQtYTQyNy00NTQxLTg5MTUtMDI1NzZkMzc3ZWM4IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiT3hzXC9WVXZPeG5yVnVQejhTYmdMTTBJcFwvNEdHVDFHTFwvRWFcLzFkWmZSUE5meEt6OXdybFRNT0FrN08zbUdweU4ifQ== x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [10.239.127.40] Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [dpdk-dev] [PATCH v2] gro: add missing invalid packet checks X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Jan 2019 05:05:33 -0000 Tested-by: Yinan Wang Best Wishes, Yinan -----Original Message----- From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Jiayu Hu Sent: 2019=1B$BG/=1B(B1=1B$B7n=1B(B10=1B$BF|=1B(B 23:06 To: dev@dpdk.org Cc: Ananyev, Konstantin ; thomas@monjalon.net= ; Hu, Jiayu ; stable@dpdk.org Subject: [dpdk-dev] [PATCH v2] gro: add missing invalid packet checks Currently, GRO library doesn't check if input packets have invalid headers.= The packets with invalid headers will also be processed by GRO. However, GRO shouldn't process invalid packets. This patch adds missing inv= alid packet checks. Fixes: 0d2cbe59b719 ("lib/gro: support TCP/IPv4") Fixes: 9e0b9d2ec0f4 ("gro: support VxLAN GRO") Cc: stable@dpdk.org Signed-off-by: Jiayu Hu --- changes in v2: - fix VxLAN header length check bug for VxLAN GRO; - fix ethernet header length check bug; - use sizeof() and macro to present valid header length; - add VLAN related comments since GRO cannot process VLAN tagged packets. lib/librte_gro/gro_tcp4.c | 12 ++++++++++++ lib/librte_gro/gro_tcp4.h | 10 ++++++++++ lib/librte_gro/gro_vxlan_tcp4.c | 15 +++++++++++++++ 3 files changed, 37 insertions(+) diff --git a/lib/librte_gro/gro_tcp4.c b/lib/librte_gro/gro_tcp4.c index 2f= e9aab..48076e0 100644 --- a/lib/librte_gro/gro_tcp4.c +++ b/lib/librte_gro/gro_tcp4.c @@ -208,6 +208,18 @@ gro_tcp4_reassemble(struct rte_mbuf *pkt, int cmp; uint8_t find; =20 + /* + * Don't process the packet whose Ethernet, IPv4 and TCP header + * lengths are invalid. + * + * In addition, GRO doesn't process the packet that is VLAN + * tagged or whose the IPv4 header contains Options. + */ + if (unlikely(ILLEGAL_ETHER_HDRLEN(pkt->l2_len) || + ILLEGAL_IPV4_HDRLEN(pkt->l3_len) || + ILLEGAL_TCP_HDRLEN(pkt->l4_len))) + return -1; + eth_hdr =3D rte_pktmbuf_mtod(pkt, struct ether_hdr *); ipv4_hdr =3D (struct ipv4_hdr *)((char *)eth_hdr + pkt->l2_len); tcp_hdr =3D (struct tcp_hdr *)((char *)ipv4_hdr + pkt->l3_len); diff --gi= t a/lib/librte_gro/gro_tcp4.h b/lib/librte_gro/gro_tcp4.h index 6bb30cd..65= bcae8 100644 --- a/lib/librte_gro/gro_tcp4.h +++ b/lib/librte_gro/gro_tcp4.h @@ -17,6 +17,16 @@ */ #define MAX_IPV4_PKT_LENGTH UINT16_MAX =20 +/* The maximum TCP header length */ +#define TCP_MAX_HLEN 60 + +#define ILLEGAL_ETHER_HDRLEN(len) ((len) !=3D ETHER_HDR_LEN) #define=20 +ILLEGAL_ETHER_VXLAN_HDRLEN(len) \ + ((len) !=3D (ETHER_VXLAN_HLEN + ETHER_HDR_LEN)) #define=20 +ILLEGAL_IPV4_HDRLEN(len) ((len) !=3D sizeof(struct ipv4_hdr)) #define=20 +ILLEGAL_TCP_HDRLEN(len) \ + (((len) < sizeof(struct tcp_hdr)) || ((len) > TCP_MAX_HLEN)) + /* Header fields representing a TCP/IPv4 flow */ struct tcp4_flow_key { struct ether_addr eth_saddr; diff --git a/lib/librte_gro/gro_vxlan_tcp4.c b/lib/librte_gro/gro_vxlan_tcp= 4.c index 955ae4b..72d63bc 100644 --- a/lib/librte_gro/gro_vxlan_tcp4.c +++ b/lib/librte_gro/gro_vxlan_tcp4.c @@ -306,6 +306,21 @@ gro_vxlan_tcp4_reassemble(struct rte_mbuf *pkt, uint16_t hdr_len; uint8_t find; =20 + /* + * Don't process the packet whose outer Ethernet, outer IPv4, + * VxLAN header, inner Ethernet, inner IPv4 and inner TCP + * header lengths are invalid. + * + * In addition, GRO doesn't process the packet that is VLAN + * tagged or whose IPv4 header contains Options. + */ + if (unlikely(ILLEGAL_ETHER_HDRLEN(pkt->outer_l2_len) || + ILLEGAL_IPV4_HDRLEN(pkt->outer_l3_len) || + ILLEGAL_ETHER_VXLAN_HDRLEN(pkt->l2_len) || + ILLEGAL_IPV4_HDRLEN(pkt->l3_len) || + ILLEGAL_TCP_HDRLEN(pkt->l4_len))) + return -1; + outer_eth_hdr =3D rte_pktmbuf_mtod(pkt, struct ether_hdr *); outer_ipv4_hdr =3D (struct ipv4_hdr *)((char *)outer_eth_hdr + pkt->outer_l2_len); -- 2.7.4