From cc213ea8956059adadf378ca454678f3d2055e04 Mon Sep 17 00:00:00 2001 From: Darrell Ball Date: Mon, 23 Sep 2019 16:44:33 -0700 Subject: conntrack: Fix 'check_orig_tuple()' Valgrind false positive. Valgrind reported that 'pkt->md.ct_orig_tuple.ipv4.ipv4_proto' is uninitialized in 'check_orig_tuple()', if 'ct_state' is zero. Although this is true, the check is superceded, as even if it succeeds the check for natted packets based on 'ct_state' is an ORed condition and is intended to catch this case. The check is '!(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT))' which filters out all packets excepted natted ones. Move this check up to prevent the Valgrind complaint, which also helps performance and also remove recenlty added redundant check adding extra cycles. Fixes: f44733c527da ("conntrack: Validate accessing of conntrack data in pkt_metadata.") CC: Yifeng Sun Signed-off-by: Darrell Ball Signed-off-by: Ben Pfaff --- lib/conntrack.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lib/conntrack.c b/lib/conntrack.c index 86c16b2fb..0c917543c 100644 --- a/lib/conntrack.c +++ b/lib/conntrack.c @@ -1001,11 +1001,11 @@ check_orig_tuple(struct conntrack *ct, struct dp_packet *pkt, struct conn **conn, const struct nat_action_info_t *nat_action_info) { - if ((ctx_in->key.dl_type == htons(ETH_TYPE_IP) && + if (!(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT)) || + (ctx_in->key.dl_type == htons(ETH_TYPE_IP) && !pkt->md.ct_orig_tuple.ipv4.ipv4_proto) || (ctx_in->key.dl_type == htons(ETH_TYPE_IPV6) && !pkt->md.ct_orig_tuple.ipv6.ipv6_proto) || - !(pkt->md.ct_state & (CS_SRC_NAT | CS_DST_NAT)) || nat_action_info) { return false; } @@ -1138,8 +1138,7 @@ process_one(struct conntrack *ct, struct dp_packet *pkt, handle_nat(pkt, conn, zone, ctx->reply, ctx->icmp_related); } - } else if (pkt->md.ct_state - && check_orig_tuple(ct, pkt, ctx, now, &conn, nat_action_info)) { + } else if (check_orig_tuple(ct, pkt, ctx, now, &conn, nat_action_info)) { create_new_conn = conn_update_state(ct, pkt, ctx, conn, now); } else { if (ctx->icmp_related) { -- 2.14.1