From: Simon Horman <simon.horman@corigine•com>
To: Xin Long <lucien.xin@gmail•com>
Cc: netfilter-devel@vger•kernel.org,
network dev <netdev@vger•kernel.org>,
Pablo Neira Ayuso <pablo@netfilter•org>,
Jozsef Kadlecsik <kadlec@netfilter•org>,
Florian Westphal <fw@strlen•de>,
davem@davemloft•net, kuba@kernel•org,
Eric Dumazet <edumazet@google•com>,
Paolo Abeni <pabeni@redhat•com>, Roopa Prabhu <roopa@nvidia•com>,
Nikolay Aleksandrov <razor@blackwall•org>,
Pravin B Shelar <pshelar@ovn•org>,
Aaron Conole <aconole@redhat•com>
Subject: Re: [PATCH nf-next 5/6] netfilter: use nf_ip6_check_hbh_len in nf_ct_skb_network_trim
Date: Mon, 6 Mar 2023 17:35:11 +0100 [thread overview]
Message-ID: <ZAYWP1FbItjLN48Y@corigine.com> (raw)
In-Reply-To: <5411027934a79f0430edb905ad4b434ec6b8396e.1677888566.git.lucien.xin@gmail.com>
On Fri, Mar 03, 2023 at 07:12:41PM -0500, Xin Long wrote:
> For IPv6 Jumbo packets, the ipv6_hdr(skb)->payload_len is always 0,
> and its real payload_len ( > 65535) is saved in hbh exthdr. With 0
> length for the jumbo packets, all data and exthdr will be trimmed
> in nf_ct_skb_network_trim().
>
> This patch is to call nf_ip6_check_hbh_len() to get real pkt_len
> of the IPv6 packet, similar to br_validate_ipv6().
>
> Signed-off-by: Xin Long <lucien.xin@gmail•com>
Reviewed-by: Simon Horman <simon.horman@corigine•com>
...
> diff --git a/net/netfilter/nf_conntrack_ovs.c b/net/netfilter/nf_conntrack_ovs.c
> index 52b776bdf526..2016a3b05f86 100644
> --- a/net/netfilter/nf_conntrack_ovs.c
> +++ b/net/netfilter/nf_conntrack_ovs.c
...
> @@ -114,14 +115,20 @@ EXPORT_SYMBOL_GPL(nf_ct_add_helper);
> int nf_ct_skb_network_trim(struct sk_buff *skb, int family)
> {
> unsigned int len;
> + int err;
>
> switch (family) {
> case NFPROTO_IPV4:
> len = skb_ip_totlen(skb);
> break;
> case NFPROTO_IPV6:
> - len = sizeof(struct ipv6hdr)
> - + ntohs(ipv6_hdr(skb)->payload_len);
> + len = ntohs(ipv6_hdr(skb)->payload_len);
> + if (ipv6_hdr(skb)->nexthdr == NEXTHDR_HOP) {
nit: if you spin a v2,
you may consider reducing the scope of err to this block.
> + err = nf_ip6_check_hbh_len(skb, &len);
> + if (err)
> + return err;
> + }
> + len += sizeof(struct ipv6hdr);
> break;
> default:
> len = skb->len;
> --
> 2.39.1
>
next prev parent reply other threads:[~2023-03-06 16:44 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-04 0:12 [PATCH nf-next 0/6] netfilter: handle ipv6 jumbo packets properly for bridge ovs and tc Xin Long
2023-03-04 0:12 ` [PATCH nf-next 1/6] netfilter: bridge: call pskb_may_pull in br_nf_check_hbh_len Xin Long
2023-03-06 15:52 ` Simon Horman
2023-03-07 9:16 ` Nikolay Aleksandrov
2023-03-07 18:33 ` Aaron Conole
2023-03-04 0:12 ` [PATCH nf-next 2/6] netfilter: bridge: check len before accessing more nh data Xin Long
2023-03-06 15:59 ` Simon Horman
2023-03-07 9:20 ` Nikolay Aleksandrov
2023-03-07 18:32 ` Aaron Conole
2023-03-04 0:12 ` [PATCH nf-next 3/6] netfilter: bridge: move pskb_trim_rcsum out of br_nf_check_hbh_len Xin Long
2023-03-06 16:26 ` Simon Horman
2023-03-07 9:21 ` Nikolay Aleksandrov
2023-03-07 18:32 ` Aaron Conole
2023-03-04 0:12 ` [PATCH nf-next 4/6] netfilter: move br_nf_check_hbh_len to utils Xin Long
2023-03-06 16:35 ` Simon Horman
2023-03-07 9:21 ` Nikolay Aleksandrov
2023-03-07 18:31 ` Aaron Conole
2023-03-04 0:12 ` [PATCH nf-next 5/6] netfilter: use nf_ip6_check_hbh_len in nf_ct_skb_network_trim Xin Long
2023-03-06 16:35 ` Simon Horman [this message]
2023-03-07 20:58 ` Xin Long
2023-03-07 9:22 ` Nikolay Aleksandrov
2023-03-07 18:31 ` Aaron Conole
2023-03-04 0:12 ` [PATCH nf-next 6/6] selftests: add a selftest for big tcp Xin Long
2023-03-07 18:31 ` Aaron Conole
2023-03-07 20:06 ` Xin Long
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZAYWP1FbItjLN48Y@corigine.com \
--to=simon.horman@corigine$(echo .)com \
--cc=aconole@redhat$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=fw@strlen$(echo .)de \
--cc=kadlec@netfilter$(echo .)org \
--cc=kuba@kernel$(echo .)org \
--cc=lucien.xin@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pablo@netfilter$(echo .)org \
--cc=pshelar@ovn$(echo .)org \
--cc=razor@blackwall$(echo .)org \
--cc=roopa@nvidia$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox