From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36835) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aQ8SA-0000mp-0R for qemu-devel@nongnu.org; Mon, 01 Feb 2016 01:59:14 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aQ8S6-0001jI-Qk for qemu-devel@nongnu.org; Mon, 01 Feb 2016 01:59:13 -0500 Received: from mx1.redhat.com ([209.132.183.28]:39106) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aQ8S6-0001jD-J9 for qemu-devel@nongnu.org; Mon, 01 Feb 2016 01:59:10 -0500 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id 0529B8E3F2 for ; Mon, 1 Feb 2016 06:59:10 +0000 (UTC) References: <1454264009-24094-1-git-send-email-wexu@redhat.com> <1454264009-24094-9-git-send-email-wexu@redhat.com> From: Jason Wang Message-ID: <56AF022F.5040206@redhat.com> Date: Mon, 1 Feb 2016 14:58:55 +0800 MIME-Version: 1.0 In-Reply-To: <1454264009-24094-9-git-send-email-wexu@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [RFC Patch v2 08/10] virtio-net rsc: Sanity check & More bypass cases check List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: wexu@redhat.com, qemu-devel@nongnu.org Cc: Wei Xu , victork@redhat.com, mst@redhat.com, yvugenfi@redhat.com, marcel@redhat.com, dfleytma@redhat.com On 02/01/2016 02:13 AM, wexu@redhat.com wrote: > From: Wei Xu > > More general exception cases check > 1. Incorrect version in IP header > 2. IP options & IP fragment > 3. Not a TCP packets > 4. Sanity size check to prevent buffer overflow attack. > > Signed-off-by: Wei Xu Let's squash this into previous patches too for a better bisection ability and complete implementation. > --- > hw/net/virtio-net.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 44 insertions(+) > > diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c > index b0987d0..9b44762 100644 > --- a/hw/net/virtio-net.c > +++ b/hw/net/virtio-net.c > @@ -1948,6 +1948,46 @@ static size_t virtio_net_rsc_drain_one(NetRscChain *chain, NetClientState *nc, > > return virtio_net_do_receive(nc, buf, size); > } > + > +static int32_t virtio_net_rsc_filter4(NetRscChain *chain, struct ip_header *ip, > + const uint8_t *buf, size_t size) This function checks for ip header, so need rename it to something like "virtio_net_rsc_ipv4_filter()" > +{ > + uint16_t ip_len; > + > + if (size < (TCP4_OFFSET + sizeof(tcp_header))) { > + return RSC_BYPASS; > + } > + > + /* Not an ipv4 one */ > + if (0x4 != ((0xF0 & ip->ip_ver_len) >> 4)) { Let's don't use magic value like 0x4 here. > + return RSC_BYPASS; > + } > + > + /* Don't handle packets with ip option */ > + if (5 != (0xF & ip->ip_ver_len)) { > + return RSC_BYPASS; > + } > + > + /* Don't handle packets with ip fragment */ > + if (!(htons(ip->ip_off) & IP_DF)) { > + return RSC_BYPASS; > + } > + > + if (ip->ip_p != IPPROTO_TCP) { > + return RSC_BYPASS; > + } > + > + /* Sanity check */ > + ip_len = htons(ip->ip_len); > + if (ip_len < (sizeof(struct ip_header) + sizeof(struct tcp_header)) > + || ip_len > (size - IP_OFFSET)) { > + return RSC_BYPASS; > + } > + > + return RSC_WANT; > +} > + > + > static size_t virtio_net_rsc_receive4(void *opq, NetClientState* nc, > const uint8_t *buf, size_t size) > { > @@ -1958,6 +1998,10 @@ static size_t virtio_net_rsc_receive4(void *opq, NetClientState* nc, > chain = (NetRscChain *)opq; > ip = (struct ip_header *)(buf + IP_OFFSET); > > + if (RSC_WANT != virtio_net_rsc_filter4(chain, ip, buf, size)) { > + return virtio_net_do_receive(nc, buf, size); > + } > + > ret = virtio_net_rsc_parse_tcp_ctrl((uint8_t *)ip, > (0xF & ip->ip_ver_len) << 2); > if (RSC_BYPASS == ret) {