From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57653) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aQA7w-0007u6-PG for qemu-devel@nongnu.org; Mon, 01 Feb 2016 03:46:29 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aQA7r-0006Xi-SC for qemu-devel@nongnu.org; Mon, 01 Feb 2016 03:46:28 -0500 Received: from mx1.redhat.com ([209.132.183.28]:36305) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aQA7r-0006XW-KJ for qemu-devel@nongnu.org; Mon, 01 Feb 2016 03:46:23 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id 2A911C09FA86 for ; Mon, 1 Feb 2016 08:46:23 +0000 (UTC) Message-ID: <56AF1B4C.80705@redhat.com> Date: Mon, 01 Feb 2016 16:46:04 +0800 From: Wei Xu MIME-Version: 1.0 References: <1454264009-24094-1-git-send-email-wexu@redhat.com> <1454264009-24094-9-git-send-email-wexu@redhat.com> <56AF022F.5040206@redhat.com> In-Reply-To: <56AF022F.5040206@redhat.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [RFC Patch v2 08/10] virtio-net rsc: Sanity check & More bypass cases check List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jason Wang , qemu-devel@nongnu.org Cc: Wei Xu , victork@redhat.com, mst@redhat.com, yvugenfi@redhat.com, marcel@redhat.com, dfleytma@redhat.com On 02/01/2016 02:58 PM, Jason Wang wrote: > > On 02/01/2016 02:13 AM, wexu@redhat.com wrote: >> From: Wei Xu >> >> More general exception cases check >> 1. Incorrect version in IP header >> 2. IP options & IP fragment >> 3. Not a TCP packets >> 4. Sanity size check to prevent buffer overflow attack. >> >> Signed-off-by: Wei Xu > Let's squash this into previous patches too for a better bisection > ability and complete implementation. ok. > >> --- >> hw/net/virtio-net.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ >> 1 file changed, 44 insertions(+) >> >> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c >> index b0987d0..9b44762 100644 >> --- a/hw/net/virtio-net.c >> +++ b/hw/net/virtio-net.c >> @@ -1948,6 +1948,46 @@ static size_t virtio_net_rsc_drain_one(NetRscChain *chain, NetClientState *nc, >> >> return virtio_net_do_receive(nc, buf, size); >> } >> + >> +static int32_t virtio_net_rsc_filter4(NetRscChain *chain, struct ip_header *ip, >> + const uint8_t *buf, size_t size) > This function checks for ip header, so need rename it to something like > "virtio_net_rsc_ipv4_filter()" OK. > >> +{ >> + uint16_t ip_len; >> + >> + if (size < (TCP4_OFFSET + sizeof(tcp_header))) { >> + return RSC_BYPASS; >> + } >> + >> + /* Not an ipv4 one */ >> + if (0x4 != ((0xF0 & ip->ip_ver_len) >> 4)) { > Let's don't use magic value like 0x4 here. OK. > >> + return RSC_BYPASS; >> + } >> + >> + /* Don't handle packets with ip option */ >> + if (5 != (0xF & ip->ip_ver_len)) { >> + return RSC_BYPASS; >> + } >> + >> + /* Don't handle packets with ip fragment */ >> + if (!(htons(ip->ip_off) & IP_DF)) { >> + return RSC_BYPASS; >> + } >> + >> + if (ip->ip_p != IPPROTO_TCP) { >> + return RSC_BYPASS; >> + } >> + >> + /* Sanity check */ >> + ip_len = htons(ip->ip_len); >> + if (ip_len < (sizeof(struct ip_header) + sizeof(struct tcp_header)) >> + || ip_len > (size - IP_OFFSET)) { >> + return RSC_BYPASS; >> + } >> + >> + return RSC_WANT; >> +} >> + >> + >> static size_t virtio_net_rsc_receive4(void *opq, NetClientState* nc, >> const uint8_t *buf, size_t size) >> { >> @@ -1958,6 +1998,10 @@ static size_t virtio_net_rsc_receive4(void *opq, NetClientState* nc, >> chain = (NetRscChain *)opq; >> ip = (struct ip_header *)(buf + IP_OFFSET); >> >> + if (RSC_WANT != virtio_net_rsc_filter4(chain, ip, buf, size)) { >> + return virtio_net_do_receive(nc, buf, size); >> + } >> + >> ret = virtio_net_rsc_parse_tcp_ctrl((uint8_t *)ip, >> (0xF & ip->ip_ver_len) << 2); >> if (RSC_BYPASS == ret) { >