From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=LKD4C5eK; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 2DE285A0782 for ; Tue, 04 Mar 2025 23:44:33 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1741128272; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wAsgwJAlmrS7shvCXFnKayU4zcYl4Lbuel4ffinpVWY=; b=LKD4C5eKwpbwLjuNFFXPLpCJWmfk8es8pF1gO8r8KUEVnihWsHRNCf5LAjwUs7QuXAbdCS hat0dLXfze9oSOTItfUTxCbYI8ZPyY1MamApNIM0FumevfNh5UdTvonKo5+WMAwvwPkt++ 6/QYvwBXLcNJ4+HlQBws20alX51XvQw= Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-558-zac-hEF5Okq7js-rBclydA-1; Tue, 04 Mar 2025 17:44:30 -0500 X-MC-Unique: zac-hEF5Okq7js-rBclydA-1 X-Mimecast-MFC-AGG-ID: zac-hEF5Okq7js-rBclydA_1741128270 Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-7c3cd389c67so238455085a.0 for ; Tue, 04 Mar 2025 14:44:30 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741128270; x=1741733070; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=wAsgwJAlmrS7shvCXFnKayU4zcYl4Lbuel4ffinpVWY=; b=pe/Cb7IoM8GbmZUCRvxKCWi7vuSY48rnCvV7Fhmm8Cv7rnvgNjp3E3VM033D1A/YcQ Su/GKEY6+dmHIvjpA28wuuoR11EJEoKpc17GYQjQCHKpWjlHZvRAjm5wxSfKXqr4ojyi ZOwpWjS2Q5yCohC6ML3RdNLmiVGlhCS6EDIrVnHk55QUggk6/D417QXatjBlHUiFTotW 8Q12Epgvk5Ay1b8jf22c1XsPAPNg6oR7Atvg+CqVSGbQ7y0ZyhOupbqXEbib0fn40SHG Jezwn6cYKxVTMuiqF5HCuyEcO+GbCA6XTenIAIdIIHvWVz9fox8YLqwxCuVpdBMWw7M4 PF6Q== X-Gm-Message-State: AOJu0YxO5x/ks4MsN0XdvUbLCKqN98OWfC5+Y2P28pPkchG6xSIifO5w 8Om17lS+HEgij07YmM8lwLF0t4E7lki5s3IV+RBXI5Zu3ed/pCC40b1ifmO9Dahhf0G2yKCusvI KMwPSQ6EtgvSLifTv9tQoLjca6iLVB+DRGlPBnkp7r/wHa27izw== X-Gm-Gg: ASbGncuHZTW7WU1XEyhrdBDlNaP1HRkUpE4fqQM+Z6BTF5V5pJwOdwP8n1/8S9GPVCv 27Rwfzhd7EaroxYV2LQ3tEdeE989WXulkBmXVZjHusRKQOtX6PmfmGs3SYKqeyZv5Gg7wnF58Vh sMonx5XpOcfOgqLnXwUsGA9uywdeen1KKnl79d2jizFTujAFSE+zWklt8wHwOIZfBpxxUjPF8NM 4z7+AL9UhXEJwW0DboM+UVPUMRtyYUnu4yVH9XlOAYWRm+ecohyJ8nzdg+lYDLl1K4kZfWpUPyd uzzPm0xuNHi32GkARakYwPqBeob3a96twGAVJARsW6lAoazHZc7kE8Q8PwdfUMk= X-Received: by 2002:a05:620a:2541:b0:7c3:cd38:9be1 with SMTP id af79cd13be357-7c3d8ec5d39mr223390985a.48.1741128270338; Tue, 04 Mar 2025 14:44:30 -0800 (PST) X-Google-Smtp-Source: AGHT+IFD2ViB6lPNJWYevr2OIdXypbk/sHrOhN9fiaL0RvUBimT3rp49z4M539J4rRqtcyO9271U9g== X-Received: by 2002:a05:620a:2541:b0:7c3:cd38:9be1 with SMTP id af79cd13be357-7c3d8ec5d39mr223387385a.48.1741128270010; Tue, 04 Mar 2025 14:44:30 -0800 (PST) Received: from ?IPV6:2001:4958:231f:7c01:99a2:ef22:1861:9725? ([2001:4958:231f:7c01:99a2:ef22:1861:9725]) by smtp.gmail.com with ESMTPSA id af79cd13be357-7c3c3edff13sm262162885a.69.2025.03.04.14.44.29 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 04 Mar 2025 14:44:29 -0800 (PST) Message-ID: Date: Tue, 4 Mar 2025 17:44:29 -0500 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v9 0/4] Reconstruct incoming ICMP headers for failed UDP connect and forward back To: Stefano Brivio References: <20250304012915.1517536-1-jmaloy@redhat.com> <20250304130520.40dfaa55@elisabeth> From: Jon Maloy In-Reply-To: <20250304130520.40dfaa55@elisabeth> X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: GlW-Y3x4GJNAL_FIhD4sdt9Uj4kUuP5LvjimGEZ5Imw_1741128270 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Message-ID-Hash: M5ZXRGS4PZ3MYNWUYKFKRB6MRUKIZECZ X-Message-ID-Hash: M5ZXRGS4PZ3MYNWUYKFKRB6MRUKIZECZ X-MailFrom: jmaloy@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, lvivier@redhat.com, dgibson@redhat.com X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 2025-03-04 07:05, Stefano Brivio wrote: > On Mon, 3 Mar 2025 20:29:11 -0500 > Jon Maloy wrote: > >> v2: - Added patch breaking out udp header creation from function >> tap_udp4_send(). >> - Updated the ICMP creation by using the new function. >> - Added logics to find correct flow, depending on origin. >> - All done after feedback from David Gibson. >> v3: - More changes after feedback from David Gibson. >> v4: - Even more changes after feedback from D. Gibson >> v5: - Added corresponding patches for IPv6 >> v6: - Fixed some small nits after comments from D. Gibson. >> v7: - Added handling of all rejected ICMP messages >> - Returning correct user data amount if IPv6 as per RFC 4884. >> v8: - Added MTU to ICMPv4 ICMP_FRAG_NEEDED messages. >> - Added ASSERT() validation to message creation functions. >> v9: - Using real source address of ICMP to complement destination >> address for originial UDP message when needed. >> >> Jon Maloy (4): >> tap: break out building of udp header from tap_udp4_send function >> udp: create and send ICMPv4 to local peer when applicable >> tap: break out building of udp header from tap_udp6_send function >> udp: create and send ICMPv6 to local peer when applicable > > I was about to apply those, then I realised that Coverity Scan isn't > happy about a few things, listed below. I didn't check if those are > false positives (I can have a look later or within a couple of days > unless you get to it first). > > 1. > --- > /home/sbrivio/passt/udp.c:448:2: > Type: Out-of-bounds access (ARRAY_VS_SINGLETON) > > /home/sbrivio/passt/udp.c:440:2: > 1. path: Condition "!(dlen <= 8)", taking false branch. > /home/sbrivio/passt/udp.c:444:2: > 2. path: Condition "ee->ee_type == 3", taking true branch. > /home/sbrivio/passt/udp.c:444:2: > 3. path: Condition "ee->ee_code == 4", taking true branch. > /home/sbrivio/passt/udp.c:448:2: > 4. address_of: Taking address with "&msg.ip4h" yields a singleton pointer. > /home/sbrivio/passt/udp.c:448:2: > 5. callee_ptr_arith: Passing "&msg.ip4h" to function "tap_push_ip4h" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. > /home/sbrivio/passt/tap.c:162:2: > 5.1. ptr_arith: Performing pointer arithmetic on "ip4h" in expression "ip4h + 1". > --- [...] > > 3. > --- > /home/sbrivio/passt/udp.c:449:2: > Type: Out-of-bounds access (ARRAY_VS_SINGLETON) > > /home/sbrivio/passt/udp.c:440:2: > 1. path: Condition "!(dlen <= 8)", taking false branch. > /home/sbrivio/passt/udp.c:444:2: > 2. path: Condition "ee->ee_type == 3", taking true branch. > /home/sbrivio/passt/udp.c:444:2: > 3. path: Condition "ee->ee_code == 4", taking true branch. > /home/sbrivio/passt/udp.c:449:2: > 4. address_of: Taking address with "&msg.uh" yields a singleton pointer. > /home/sbrivio/passt/udp.c:449:2: > 5. callee_ptr_arith: Passing "&msg.uh" to function "tap_push_uh4" which uses it as an array. This might corrupt or misinterpret adjacent memory locations. > /home/sbrivio/passt/tap.c:190:2: > 5.1. ptr_arith: Performing pointer arithmetic on "uh" in expression "uh + 1". > --- [...] I installed coverity and tried it, of course with the same result. These are clearly false positives, and the first one is already in the upstream code, not added by me. I can probably get rid of them with some pointer gymnastics, but is it really worth it? BTW, I discovered a bug in patch #2 which I just fixed. I will post a v10 of my patches shortly. ///jon