Ed Swierk 9382fe71c0 openvswitch: Remove padding from packet before L3+ conntrack processing ... IPv4 and IPv6 packets may arrive with lower-layer padding that is not included in the L3 length. For example, a short IPv4 packet may have up to 6 bytes of padding following the IP payload when received on an Ethernet device with a minimum packet length of 64 bytes. Higher-layer processing functions in netfilter (e.g. nf_ip_checksum(), and help() in nf_conntrack_ftp) assume skb->len reflects the length of the L3 header and payload, rather than referring back to ip_hdr->tot_len or ipv6_hdr->payload_len, and get confused by lower-layer padding. In the normal IPv4 receive path, ip_rcv() trims the packet to ip_hdr->tot_len before invoking netfilter hooks. In the IPv6 receive path, ip6_rcv() does the same using ipv6_hdr->payload_len. Similarly in the br_netfilter receive path, br_validate_ipv4() and br_validate_ipv6() trim the packet to the L3 length before invoking netfilter hooks. Currently in the OVS conntrack receive path, ovs_ct_execute() pulls the skb to the L3 header but does not trim it to the L3 length before calling nf_conntrack_in(NF_INET_PRE_ROUTING). When nf_conntrack_proto_tcp encounters a packet with lower-layer padding, nf_ip_checksum() fails causing a "nf_ct_tcp: bad TCP checksum" log message. While extra zero bytes don't affect the checksum, the length in the IP pseudoheader does. That length is based on skb->len, and without trimming, it doesn't match the length the sender used when computing the checksum. In ovs_ct_execute(), trim the skb to the L3 length before higher-layer processing. Signed-off-by: Ed Swierk <eswierk@skyportsystems.com> Acked-by: Pravin B Shelar <pshelar@ovn.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-02-01 09:46:22 -05:00
..
actions.c
conntrack.c	openvswitch: Remove padding from packet before L3+ conntrack processing	2018-02-01 09:46:22 -05:00
conntrack.h
datapath.c	net: openvswitch: datapath: fix data type in queue_gso_packets	2017-11-27 02:15:33 +09:00
datapath.h
dp_notify.c
flow_netlink.c	openvswitch: add erspan version I and II support	2018-01-25 21:39:43 -05:00
flow_netlink.h
flow_table.c
flow_table.h
flow.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-12-22 11:16:31 -05:00
flow.h
Kconfig
Makefile
meter.c	openvswitch: meter: Use 64-bit arithmetic instead of 32-bit	2018-01-31 10:26:30 -05:00
meter.h
vport-geneve.c
vport-gre.c
vport-internal_dev.c	net: ovs: remove unused hardirq.h	2018-01-08 20:59:25 -05:00
vport-internal_dev.h
vport-netdev.c
vport-netdev.h
vport-vxlan.c
vport.c
vport.h