Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 2231776,
    "url": "http://patchwork.ozlabs.org/api/1.1/patches/2231776/?format=api",
    "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260501122237.296262-9-pablo@netfilter.org/",
    "project": {
        "id": 26,
        "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api",
        "name": "Netfilter Development",
        "link_name": "netfilter-devel",
        "list_id": "netfilter-devel.vger.kernel.org",
        "list_email": "netfilter-devel@vger.kernel.org",
        "web_url": null,
        "scm_url": null,
        "webscm_url": null
    },
    "msgid": "<20260501122237.296262-9-pablo@netfilter.org>",
    "date": "2026-05-01T12:22:31",
    "name": "[net,08/14] netfilter: nf_socket: skip socket lookup for non-first fragments",
    "commit_ref": null,
    "pull_url": null,
    "state": "new",
    "archived": false,
    "hash": "a5aa5aa53da4ad56e8db30c5642d0fa3fc3cd54e",
    "submitter": {
        "id": 1315,
        "url": "http://patchwork.ozlabs.org/api/1.1/people/1315/?format=api",
        "name": "Pablo Neira Ayuso",
        "email": "pablo@netfilter.org"
    },
    "delegate": null,
    "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260501122237.296262-9-pablo@netfilter.org/mbox/",
    "series": [
        {
            "id": 502449,
            "url": "http://patchwork.ozlabs.org/api/1.1/series/502449/?format=api",
            "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=502449",
            "date": "2026-05-01T12:22:23",
            "name": "[net,01/14] netfilter: replace skb_try_make_writable() by skb_ensure_writable()",
            "version": 1,
            "mbox": "http://patchwork.ozlabs.org/series/502449/mbox/"
        }
    ],
    "comments": "http://patchwork.ozlabs.org/api/patches/2231776/comments/",
    "check": "pending",
    "checks": "http://patchwork.ozlabs.org/api/patches/2231776/checks/",
    "tags": {},
    "headers": {
        "Return-Path": "\n <netfilter-devel+bounces-12379-incoming=patchwork.ozlabs.org@vger.kernel.org>",
        "X-Original-To": [
            "incoming@patchwork.ozlabs.org",
            "netfilter-devel@vger.kernel.org"
        ],
        "Delivered-To": "patchwork-incoming@legolas.ozlabs.org",
        "Authentication-Results": [
            "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=wKqt8mZ+;\n\tdkim-atps=neutral",
            "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12379-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)",
            "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"wKqt8mZ+\"",
            "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124",
            "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org",
            "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org"
        ],
        "Received": [
            "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g6VcQ2z9jz1xqf\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 01 May 2026 22:25:26 +1000 (AEST)",
            "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 7DEC630421D5\n\tfor <incoming@patchwork.ozlabs.org>; Fri,  1 May 2026 12:22:57 +0000 (UTC)",
            "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 840703A1E9E;\n\tFri,  1 May 2026 12:22:56 +0000 (UTC)",
            "from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id A3F053A1CEA;\n\tFri,  1 May 2026 12:22:54 +0000 (UTC)",
            "from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id B54E060253;\n\tFri,  1 May 2026 14:22:52 +0200 (CEST)"
        ],
        "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777638176; cv=none;\n b=IDSbFo1FjunjCsSuLvNdiULjdGD3ec/34fEPpetQtZmG2PyyUjHvutLwj6wSUm62PBQjeR+USYw2QduWK+8C4fTt5FmiVLgPZo3KtiP5dKjNlmZcK8uXnlZowejhFkpWIat56uJplqE/FXFodfJJ5JEMGYFk0SHTQSttrkGlo4c=",
        "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777638176; c=relaxed/simple;\n\tbh=iGCgKKAZjuVFe8NtGypebr2FL+6Q+sjCRSubmoZeE3Q=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=FhftahwUmP3yrBQjfISxvDewPcSLfJFqAEyHlWwSxoRjt5DNadJJCd0WPJW8jyRn+wx8j2VggoaznIddIlOCYx9Gxs9Kx5ltUcwe9YHSR9g9ejND28YBfDsu+XZKzS/azQbbCySDmC9a+ml01aVHOOvcRUSKHcXtAX/1joaVag0=",
        "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=wKqt8mZ+; arc=none smtp.client-ip=217.70.190.124",
        "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1777638173;\n\tbh=6S4r3Pu5p6LNj+T8frNczIDvTk2FQ6ZslXgCCio8jsM=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=wKqt8mZ++gkA62ec7xICkI7komtSl5D3tbV3w6ggzEDDeVYSqfqc4j3giEBhTOlio\n\t Z68583Lrs221Rr1bNRzEje5gh7ipCVdZ7IkxIPP9b1XBVNtEtk853GJGJC36b020EU\n\t Mqfmqt0d8+24PL24oNYnV5GiIT6piZECZ/1b+WBq/6Po7HcN4FcsI+t3/hIdV27+SB\n\t rlqlCWw706DRCVVfQIXdVMH8v+2+KMgbxRpP3SB+EVnAqs+FsMF55ZotD2K71H4uHj\n\t u/+lrWWfYb1hi/LqUFcWZ7bCaSE+0316BdntwwmNgjE1x/e3faw0useQ/GBWUMhj3N\n\t 7JxWyssZvUA2Q==",
        "From": "Pablo Neira Ayuso <pablo@netfilter.org>",
        "To": "netfilter-devel@vger.kernel.org",
        "Cc": "davem@davemloft.net,\n\tnetdev@vger.kernel.org,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tedumazet@google.com,\n\tfw@strlen.de,\n\thorms@kernel.org",
        "Subject": "[PATCH net 08/14] netfilter: nf_socket: skip socket lookup for\n non-first fragments",
        "Date": "Fri,  1 May 2026 14:22:31 +0200",
        "Message-ID": "<20260501122237.296262-9-pablo@netfilter.org>",
        "X-Mailer": "git-send-email 2.47.3",
        "In-Reply-To": "<20260501122237.296262-1-pablo@netfilter.org>",
        "References": "<20260501122237.296262-1-pablo@netfilter.org>",
        "Precedence": "bulk",
        "X-Mailing-List": "netfilter-devel@vger.kernel.org",
        "List-Id": "<netfilter-devel.vger.kernel.org>",
        "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>",
        "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>",
        "MIME-Version": "1.0",
        "Content-Transfer-Encoding": "8bit"
    },
    "content": "From: Fernando Fernandez Mancera <fmancera@suse.de>\n\nBoth nft_socket and xt_socket relies on L4 headers to perform socket\nlookup in the slow path. For fragmented packets, while the IP protocol\nremains constant across all fragments, only the first fragment contains\nthe actual L4 header.\n\nAs the expression/match could be attached to a chain with a priority\nlower than -400, it could bypass defragmentation.\n\nAdd a check for fragmentation in the lookup functions directly so the\nproblem is handled for both nft_socket and xt_socket at the same time.\nIn addition, future users of the functions would not need to care about\nthis.\n\nFixes: 902d6a4c2a4f (\"netfilter: nf_defrag: Skip defrag if NOTRACK is set\")\nFixes: 554ced0a6e29 (\"netfilter: nf_tables: add support for native socket matching\")\nSigned-off-by: Fernando Fernandez Mancera <fmancera@suse.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/ipv4/netfilter/nf_socket_ipv4.c | 3 +++\n net/ipv6/netfilter/nf_socket_ipv6.c | 5 +++--\n 2 files changed, 6 insertions(+), 2 deletions(-)",
    "diff": "diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c\nindex 5080fa5fbf6a..f9c6755f5ec5 100644\n--- a/net/ipv4/netfilter/nf_socket_ipv4.c\n+++ b/net/ipv4/netfilter/nf_socket_ipv4.c\n@@ -94,6 +94,9 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb,\n #endif\n \tint doff = 0;\n \n+\tif (ntohs(iph->frag_off) & IP_OFFSET)\n+\t\treturn NULL;\n+\n \tif (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) {\n \t\tstruct tcphdr _hdr;\n \t\tstruct udphdr *hp;\ndiff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c\nindex ced8bd44828e..893f2aeb4711 100644\n--- a/net/ipv6/netfilter/nf_socket_ipv6.c\n+++ b/net/ipv6/netfilter/nf_socket_ipv6.c\n@@ -100,6 +100,7 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,\n \tconst struct in6_addr *daddr = NULL, *saddr = NULL;\n \tstruct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var;\n \tstruct sk_buff *data_skb = NULL;\n+\tunsigned short fragoff = 0;\n \tint doff = 0;\n \tint thoff = 0, tproto;\n #if IS_ENABLED(CONFIG_NF_CONNTRACK)\n@@ -107,8 +108,8 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,\n \tstruct nf_conn const *ct;\n #endif\n \n-\ttproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);\n-\tif (tproto < 0) {\n+\ttproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);\n+\tif (tproto < 0 || fragoff) {\n \t\tpr_debug(\"unable to find transport header in IPv6 packet, dropping\\n\");\n \t\treturn NULL;\n \t}\n",
    "prefixes": [
        "net",
        "08/14"
    ]
}