From 5c9312b40db0f205352c3533e6f7f69fa17b22ab Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Wed, 14 Aug 2024 07:16:56 -0400 Subject: [PATCH] passt-0^20240806-gee36266-2.el9 Resolves: RHEL-54268 --- ...-if-guest-attempts-to-connect-to-por.patch | 64 +++++++++++++++++++ passt.spec | 6 +- 2 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 0002-flow-Don-t-crash-if-guest-attempts-to-connect-to-por.patch diff --git a/0002-flow-Don-t-crash-if-guest-attempts-to-connect-to-por.patch b/0002-flow-Don-t-crash-if-guest-attempts-to-connect-to-por.patch new file mode 100644 index 0000000..00692fa --- /dev/null +++ b/0002-flow-Don-t-crash-if-guest-attempts-to-connect-to-por.patch @@ -0,0 +1,64 @@ +From 002b2a23380d4df552bac7665d462ac4c7bced0b Mon Sep 17 00:00:00 2001 +From: David Gibson +Date: Wed, 14 Aug 2024 20:03:33 +1000 +Subject: [PATCH] flow: Don't crash if guest attempts to connect to port 0 + +Using a zero port on TCP or UDP is dubious, and we can't really deal with +forwarding such a flow within the constraints of the socket API. Hence +we ASSERT()ed that we had non-zero ports in flow_hash(). + +The intention was to make sure that the protocol code sanitizes such ports +before completing a flow entry. Unfortunately, flow_hash() is also called +on new packets to see if they have an existing flow, so the unsanitized +guest packet can crash passt with the assert. + +Correct this by moving the assert from flow_hash() to flow_sidx_hash() +which is only used on entries already in the table, not on unsanitized +data. + +Reported-by: Matt Hamilton +Signed-off-by: David Gibson +Signed-off-by: Stefano Brivio +--- + flow.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/flow.c b/flow.c +index 687e9fd..93b687d 100644 +--- a/flow.c ++++ b/flow.c +@@ -561,12 +561,6 @@ static uint64_t flow_hash(const struct ctx *c, uint8_t proto, uint8_t pif, + { + struct siphash_state state = SIPHASH_INIT(c->hash_secret); + +- /* For the hash table to work, we need complete endpoint information, +- * and at least a forwarding port. +- */ +- ASSERT(pif != PIF_NONE && !inany_is_unspecified(&side->eaddr) && +- side->eport != 0 && side->fport != 0); +- + inany_siphash_feed(&state, &side->faddr); + inany_siphash_feed(&state, &side->eaddr); + +@@ -586,8 +580,16 @@ static uint64_t flow_hash(const struct ctx *c, uint8_t proto, uint8_t pif, + static uint64_t flow_sidx_hash(const struct ctx *c, flow_sidx_t sidx) + { + const struct flow_common *f = &flow_at_sidx(sidx)->f; +- return flow_hash(c, FLOW_PROTO(f), +- f->pif[sidx.sidei], &f->side[sidx.sidei]); ++ const struct flowside *side = &f->side[sidx.sidei]; ++ uint8_t pif = f->pif[sidx.sidei]; ++ ++ /* For the hash table to work, entries must have complete endpoint ++ * information, and at least a forwarding port. ++ */ ++ ASSERT(pif != PIF_NONE && !inany_is_unspecified(&side->eaddr) && ++ side->eport != 0 && side->fport != 0); ++ ++ return flow_hash(c, FLOW_PROTO(f), pif, side); + } + + /** +-- +2.43.0 + diff --git a/passt.spec b/passt.spec index bdd56b8..6b9e6f5 100644 --- a/passt.spec +++ b/passt.spec @@ -12,7 +12,7 @@ Name: passt Version: 0^20240806.gee36266 -Release: 1%{?dist} +Release: 2%{?dist} Summary: User-mode networking daemons for virtual machines and namespaces License: GPL-2.0-or-later AND BSD-3-Clause Group: System Environment/Daemons @@ -20,6 +20,7 @@ URL: https://passt.top/ Source: https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz Patch1: 0001-selinux-Drop-user_namespace-create-allow-rules.patch +Patch2: 0002-flow-Don-t-crash-if-guest-attempts-to-connect-to-por.patch BuildRequires: gcc, make, git, checkpolicy, selinux-policy-devel Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype}) @@ -126,6 +127,9 @@ fi %{_datadir}/selinux/packages/%{selinuxtype}/pasta.pp %changelog +* Wed Aug 14 2024 Stefano Brivio - 0^20240806-gee36266-2 +- Resolves: RHEL-54268 + * Wed Aug 7 2024 Stefano Brivio - 0^20240806.gee36266-1 - Resolves: RHEL-53189