mbox series

[net,v2,0/2] net: openvswitch: limit the recursions from action sets

Message ID 20240207132416.1488485-1-aconole@redhat.com
Headers show
Series net: openvswitch: limit the recursions from action sets | expand

Message

Aaron Conole Feb. 7, 2024, 1:24 p.m. UTC 
Open vSwitch module accepts actions as a list from the netlink socket
and then creates a copy which it uses in the action set processing.
During processing of the action list on a packet, the module keeps a
count of the execution depth and exits processing if the action depth
goes too high.

However, during netlink processing the recursion depth isn't checked
anywhere, and the copy trusts that kernel has large enough stack to
accommodate it.  The OVS sample action was the original action which
could perform this kinds of recursion, and it originally checked that
it didn't exceed the sample depth limit.  However, when sample became
optimized to provide the clone() semantics, the recursion limit was
dropped.

This series adds a depth limit during the __ovs_nla_copy_actions() call
that will ensure we don't exceed the max that the OVS userspace could
generate for a clone().

Additionally, this series provides a selftest in 2/2 that can be used to
determine if the OVS module is allowing unbounded access.  It can be
safely omitted where the ovs selftest framework isn't available.

Aaron Conole (2):
  net: openvswitch: limit the number of recursions from action sets
  selftests: openvswitch: Add validation for the recursion test

 net/openvswitch/flow_netlink.c                | 49 ++++++++-----
 .../selftests/net/openvswitch/openvswitch.sh  | 13 ++++
 .../selftests/net/openvswitch/ovs-dpctl.py    | 71 +++++++++++++++----
 3 files changed, 102 insertions(+), 31 deletions(-)

Comments

Simon Horman Feb. 8, 2024, 11:29 a.m. UTC | #1 
On Wed, Feb 07, 2024 at 08:24:15AM -0500, Aaron Conole wrote:
> The ovs module allows for some actions to recursively contain an action
> list for complex scenarios, such as sampling, checking lengths, etc.
> When these actions are copied into the internal flow table, they are
> evaluated to validate that such actions make sense, and these calls
> happen recursively.
> 
> The ovs-vswitchd userspace won't emit more than 16 recursion levels
> deep.  However, the module has no such limit and will happily accept
> limits larger than 16 levels nested.  Prevent this by tracking the
> number of recursions happening and manually limiting it to 16 levels
> nested.
> 
> The initial implementation of the sample action would track this depth
> and prevent more than 3 levels of recursion, but this was removed to
> support the clone use case, rather than limited at the current userspace
> limit.
> 
> Fixes: 798c166173ff ("openvswitch: Optimize sample action for the clone use cases")
> Signed-off-by: Aaron Conole <aconole@redhat.com>
> ---
> v1->v2: Switch to tracking the stack depth by using a depth argument rather than
>         a per-cpu counter.

Thanks for the update.

Reviewed-by: Simon Horman <horms@kernel.org>
patchwork-bot+netdevbpf@kernel.org Feb. 9, 2024, 9 p.m. UTC | #2 
Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  7 Feb 2024 08:24:14 -0500 you wrote:
> Open vSwitch module accepts actions as a list from the netlink socket
> and then creates a copy which it uses in the action set processing.
> During processing of the action list on a packet, the module keeps a
> count of the execution depth and exits processing if the action depth
> goes too high.
> 
> However, during netlink processing the recursion depth isn't checked
> anywhere, and the copy trusts that kernel has large enough stack to
> accommodate it.  The OVS sample action was the original action which
> could perform this kinds of recursion, and it originally checked that
> it didn't exceed the sample depth limit.  However, when sample became
> optimized to provide the clone() semantics, the recursion limit was
> dropped.
> 
> [...]

Here is the summary with links:
  - [net,v2,1/2] net: openvswitch: limit the number of recursions from action sets
    https://git.kernel.org/netdev/net/c/6e2f90d31fe0
  - [net,v2,2/2] selftests: openvswitch: Add validation for the recursion test
    https://git.kernel.org/netdev/net/c/bd128f62c365

You are awesome, thank you!