Re: [PATCH v2] openvswitch: Trim off padding before L3+ netfilter processing

On Fri, Jan 5, 2018 at 3:20 PM, Ed Swierk [off-list ref] wrote:

On Fri, Jan 5, 2018 at 10:14 AM, Ed Swierk [off-list ref]
wrote:

quoted

On Thu, Jan 4, 2018 at 7:36 PM, Pravin Shelar [off-list ref] wrote:

quoted

OVS already pull all required headers in skb linear data, so no need
to redo all of it. only check required is the ip-checksum validation.
I think we could avoid it in most of cases by checking skb length to
ipheader length before verifying the ip header-checksum.

Shouldn't the IP header checksum be verified even earlier, like in
key_extract(), before actually using any of the fields in the IP
header?

Something like this for verifying the IP header checksum (not tested):

AFAIU openflow does not need this verification, so it is not required
in flow extract.