[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [RFC Patch v2 08/10] virtio-net rsc: Sanity check & Mor
From: |
Jason Wang |
Subject: |
Re: [Qemu-devel] [RFC Patch v2 08/10] virtio-net rsc: Sanity check & More bypass cases check |
Date: |
Mon, 1 Feb 2016 14:58:55 +0800 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 |
On 02/01/2016 02:13 AM, address@hidden wrote:
> From: Wei Xu <address@hidden>
>
> More general exception cases check
> 1. Incorrect version in IP header
> 2. IP options & IP fragment
> 3. Not a TCP packets
> 4. Sanity size check to prevent buffer overflow attack.
>
> Signed-off-by: Wei Xu <address@hidden>
Let's squash this into previous patches too for a better bisection
ability and complete implementation.
> ---
> hw/net/virtio-net.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 44 insertions(+)
>
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index b0987d0..9b44762 100644
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -1948,6 +1948,46 @@ static size_t virtio_net_rsc_drain_one(NetRscChain
> *chain, NetClientState *nc,
>
> return virtio_net_do_receive(nc, buf, size);
> }
> +
> +static int32_t virtio_net_rsc_filter4(NetRscChain *chain, struct ip_header
> *ip,
> + const uint8_t *buf, size_t size)
This function checks for ip header, so need rename it to something like
"virtio_net_rsc_ipv4_filter()"
> +{
> + uint16_t ip_len;
> +
> + if (size < (TCP4_OFFSET + sizeof(tcp_header))) {
> + return RSC_BYPASS;
> + }
> +
> + /* Not an ipv4 one */
> + if (0x4 != ((0xF0 & ip->ip_ver_len) >> 4)) {
Let's don't use magic value like 0x4 here.
> + return RSC_BYPASS;
> + }
> +
> + /* Don't handle packets with ip option */
> + if (5 != (0xF & ip->ip_ver_len)) {
> + return RSC_BYPASS;
> + }
> +
> + /* Don't handle packets with ip fragment */
> + if (!(htons(ip->ip_off) & IP_DF)) {
> + return RSC_BYPASS;
> + }
> +
> + if (ip->ip_p != IPPROTO_TCP) {
> + return RSC_BYPASS;
> + }
> +
> + /* Sanity check */
> + ip_len = htons(ip->ip_len);
> + if (ip_len < (sizeof(struct ip_header) + sizeof(struct tcp_header))
> + || ip_len > (size - IP_OFFSET)) {
> + return RSC_BYPASS;
> + }
> +
> + return RSC_WANT;
> +}
> +
> +
> static size_t virtio_net_rsc_receive4(void *opq, NetClientState* nc,
> const uint8_t *buf, size_t size)
> {
> @@ -1958,6 +1998,10 @@ static size_t virtio_net_rsc_receive4(void *opq,
> NetClientState* nc,
> chain = (NetRscChain *)opq;
> ip = (struct ip_header *)(buf + IP_OFFSET);
>
> + if (RSC_WANT != virtio_net_rsc_filter4(chain, ip, buf, size)) {
> + return virtio_net_do_receive(nc, buf, size);
> + }
> +
> ret = virtio_net_rsc_parse_tcp_ctrl((uint8_t *)ip,
> (0xF & ip->ip_ver_len) << 2);
> if (RSC_BYPASS == ret) {
- Re: [Qemu-devel] [RFC Patch v2 08/10] virtio-net rsc: Sanity check & More bypass cases check,
Jason Wang <=