personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-08-15 14:47:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

virtio: reject the GSO_ECN qualifier on non-TCP GSO types

Browse Source 
35596c7 added the udp-l4-ecn-rejected test but only the ECN mask, so
UDP_L4|ECN validated as plain UDP_L4. Mirror virtio_net_hdr_to_skb and
refuse ECN on anything but TCPV4/TCPV6.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
JackDoan
2026-07-28 10:54:03 -05:00
parent b7d06615c0
commit 46a02b663e
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
overlay/tio/virtio/segment_linux.go
+8
View File
@@ -87,6 +87,14 @@ func CheckValid(pkt []byte, hdr Hdr) error {
//mask out VIRTIO_NET_HDR_GSO_ECN, it's a qualifier, not a type
gsoType := hdr.GSOType &^ unix.VIRTIO_NET_HDR_GSO_ECN
// The ECN qualifier means CWR was set on a TSO superpacket, so it only
// applies to the TCP types. The kernel's virtio_net_hdr_to_skb rejects
// it on anything else; mirror that instead of segmenting nonsense.
if hdr.GSOType&unix.VIRTIO_NET_HDR_GSO_ECN != 0 &&
gsoType != unix.VIRTIO_NET_HDR_GSO_TCPV4 &&
gsoType != unix.VIRTIO_NET_HDR_GSO_TCPV6 {
return fmt.Errorf("virtio GSO_ECN qualifier on non-TCP GSO type %#x", hdr.GSOType)
}
switch gsoType {
case unix.VIRTIO_NET_HDR_GSO_TCPV4:
if ipVersion != 4 {