Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2231777/?format=api
{ "id": 2231777, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2231777/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260501122237.296262-11-pablo@netfilter.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260501122237.296262-11-pablo@netfilter.org>", "date": "2026-05-01T12:22:33", "name": "[net,10/14] netfilter: xtables: fix L4 header parsing for non-first fragments", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "9dbb35adc65aab4e2d60f386c4af172624dd4244", "submitter": { "id": 1315, "url": "http://patchwork.ozlabs.org/api/1.1/people/1315/?format=api", "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260501122237.296262-11-pablo@netfilter.org/mbox/", "series": [ { "id": 502449, "url": "http://patchwork.ozlabs.org/api/1.1/series/502449/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=502449", "date": "2026-05-01T12:22:23", "name": "[net,01/14] netfilter: replace skb_try_make_writable() by skb_ensure_writable()", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/502449/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2231777/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2231777/checks/", "tags": {}, "headers": { "Return-Path": "\n <netfilter-devel+bounces-12380-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=Nikf5LU+;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12380-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"Nikf5LU+\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g6Vcy3QQBz1xqf\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 01 May 2026 22:25:54 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 5F60E304855F\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 1 May 2026 12:23:00 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id A1F5D3A2544;\n\tFri, 1 May 2026 12:22:59 +0000 (UTC)", "from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AE8C3A1E69;\n\tFri, 1 May 2026 12:22:57 +0000 (UTC)", "from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id 2DCDD60254;\n\tFri, 1 May 2026 14:22:55 +0200 (CEST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777638179; cv=none;\n b=jHfHlCIYdSGcwDFbYFhgw2fR5nIwiKyt8RiZiIWg6/u6nOJ0Uxt5vrb/9dENTO3cspLxn91re59C9ZFvD+yJW0zwDrVjprCnXDGOWyVu7PQB/T3YMFhPqOKCw/pzTEl3Rr8M/OTX+erFhtVaElBAWBZmlresrP9SJI2IX6Zfhkk=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777638179; c=relaxed/simple;\n\tbh=tNhHT6Abv/3zT8k+dHNKaWWWmJxFJX3NgbugeEhWMX0=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=oKemPZdNHou9TI8ec6ZJjJgXH700zK6Dacokpkf480ZMZKa/Cu/XipCxi53/lbX/PlGD2HGDoylhTXr/3+c7ExmX8MxSV016k4mqVf9c8XHIvdhqdUk/bpFVTIQeXND0y83N7/xfAWh7gX92HOtFuqOKkhjli/PpnfRhjxidaO4=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=Nikf5LU+; arc=none smtp.client-ip=217.70.190.124", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1777638175;\n\tbh=cR6WNktAkRA0KiTvVIoCiQDDxvWm++CwvuGFEmxHJkc=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=Nikf5LU+3WYCXSAB6F+leXSn1bUWtgZagWIqXhSAGS4l5RaCUs4OE+aeKE3eEZFnq\n\t zxnGVN8qScLZl9j2LF5wndmn3IYe7QIfH43MeTyACxZtvH1gVrBfhKb61hY3vLJruS\n\t 5vmn6iODCs6iUSOYwtIxoS/b/XcJVFgJIjZJ+Sw2ebZdZnCt6qqzj6CUbZ9zJ1uVRG\n\t gonfzB76ifMXv/TbjSfzgazWt8m+2jxk6UAik/jLDc59pOUYHJR8XWOWxhKAhxHNfr\n\t r6WIElEuSVH5bYDksJcAhpuzHY/DeLyleakIGI/lxSfrksyd8CBhdQFiwu6l5Hf3BI\n\t lJPvVYO1oqsAA==", "From": "Pablo Neira Ayuso <pablo@netfilter.org>", "To": "netfilter-devel@vger.kernel.org", "Cc": "davem@davemloft.net,\n\tnetdev@vger.kernel.org,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tedumazet@google.com,\n\tfw@strlen.de,\n\thorms@kernel.org", "Subject": "[PATCH net 10/14] netfilter: xtables: fix L4 header parsing for\n non-first fragments", "Date": "Fri, 1 May 2026 14:22:33 +0200", "Message-ID": "<20260501122237.296262-11-pablo@netfilter.org>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<20260501122237.296262-1-pablo@netfilter.org>", "References": "<20260501122237.296262-1-pablo@netfilter.org>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "From: Fernando Fernandez Mancera <fmancera@suse.de>\n\nMultiple targets and matches relies on L4 header to operate. For\nfragmented packets, every fragment carries the transport protocol\nidentifier, but only the first fragment contains the L4 header.\n\nAs the 'raw' table can be configured to run at priority -450 (before\ndefragmentation at -400), the target/match can be reached before\nreassembly. In this case, non-first fragments have their payload\nincorrectly parsed as a TCP/UDP header. This would be of course a\nmisconfiguration scenario. In most of the cases this just lead to a\nunreliable behavior for fragmented traffic.\n\nAdd a fragment check to ensure target/match only evaluates unfragmented\npackets or the first fragment in the stream.\n\nFixes: 902d6a4c2a4f (\"netfilter: nf_defrag: Skip defrag if NOTRACK is set\")\nSigned-off-by: Fernando Fernandez Mancera <fmancera@suse.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/netfilter/xt_TPROXY.c | 11 +++++++++--\n net/netfilter/xt_ecn.c | 4 ++++\n net/netfilter/xt_hashlimit.c | 4 +++-\n net/netfilter/xt_osf.c | 3 +++\n net/netfilter/xt_tcpmss.c | 4 ++++\n 5 files changed, 23 insertions(+), 3 deletions(-)", "diff": "diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c\nindex e4bea1d346cf..5f60e7298a1e 100644\n--- a/net/netfilter/xt_TPROXY.c\n+++ b/net/netfilter/xt_TPROXY.c\n@@ -86,6 +86,9 @@ tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par)\n {\n \tconst struct xt_tproxy_target_info *tgi = par->targinfo;\n \n+\tif (par->fragoff)\n+\t\treturn NF_DROP;\n+\n \treturn tproxy_tg4(xt_net(par), skb, tgi->laddr, tgi->lport,\n \t\t\t tgi->mark_mask, tgi->mark_value);\n }\n@@ -95,6 +98,9 @@ tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par)\n {\n \tconst struct xt_tproxy_target_info_v1 *tgi = par->targinfo;\n \n+\tif (par->fragoff)\n+\t\treturn NF_DROP;\n+\n \treturn tproxy_tg4(xt_net(par), skb, tgi->laddr.ip, tgi->lport,\n \t\t\t tgi->mark_mask, tgi->mark_value);\n }\n@@ -106,6 +112,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)\n {\n \tconst struct ipv6hdr *iph = ipv6_hdr(skb);\n \tconst struct xt_tproxy_target_info_v1 *tgi = par->targinfo;\n+\tunsigned short fragoff = 0;\n \tstruct udphdr _hdr, *hp;\n \tstruct sock *sk;\n \tconst struct in6_addr *laddr;\n@@ -113,8 +120,8 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)\n \tint thoff = 0;\n \tint tproto;\n \n-\ttproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);\n-\tif (tproto < 0)\n+\ttproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);\n+\tif (tproto < 0 || fragoff)\n \t\treturn NF_DROP;\n \n \thp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);\ndiff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c\nindex b96e8203ac54..a8503f5d26bf 100644\n--- a/net/netfilter/xt_ecn.c\n+++ b/net/netfilter/xt_ecn.c\n@@ -30,6 +30,10 @@ static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par)\n \tstruct tcphdr _tcph;\n \tconst struct tcphdr *th;\n \n+\t/* this is fine for IPv6 as ecn_mt_check6() enforces -p tcp */\n+\tif (par->fragoff)\n+\t\treturn false;\n+\n \t/* In practice, TCP match does this, so can't fail. But let's\n \t * be good citizens.\n \t */\ndiff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c\nindex 3bd127bfc114..2704b4b60d1e 100644\n--- a/net/netfilter/xt_hashlimit.c\n+++ b/net/netfilter/xt_hashlimit.c\n@@ -658,6 +658,8 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,\n \t\tif (!(hinfo->cfg.mode &\n \t\t (XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))\n \t\t\treturn 0;\n+\t\tif (ntohs(ip_hdr(skb)->frag_off) & IP_OFFSET)\n+\t\t\treturn -1;\n \t\tnexthdr = ip_hdr(skb)->protocol;\n \t\tbreak;\n #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)\n@@ -681,7 +683,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,\n \t\t\treturn 0;\n \t\tnexthdr = ipv6_hdr(skb)->nexthdr;\n \t\tprotoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off);\n-\t\tif ((int)protoff < 0)\n+\t\tif ((int)protoff < 0 || ntohs(frag_off) & IP6_OFFSET)\n \t\t\treturn -1;\n \t\tbreak;\n \t}\ndiff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c\nindex dc9485854002..e8807caede68 100644\n--- a/net/netfilter/xt_osf.c\n+++ b/net/netfilter/xt_osf.c\n@@ -27,6 +27,9 @@\n static bool\n xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)\n {\n+\tif (p->fragoff)\n+\t\treturn false;\n+\n \treturn nf_osf_match(skb, xt_family(p), xt_hooknum(p), xt_in(p),\n \t\t\t xt_out(p), p->matchinfo, xt_net(p), nf_osf_fingers);\n }\ndiff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c\nindex 0d32d4841cb3..b9da8269161d 100644\n--- a/net/netfilter/xt_tcpmss.c\n+++ b/net/netfilter/xt_tcpmss.c\n@@ -32,6 +32,10 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)\n \tu8 _opt[15 * 4 - sizeof(_tcph)];\n \tunsigned int i, optlen;\n \n+\t/* this is fine for IPv6 as xt_tcpmss enforces -p tcp */\n+\tif (par->fragoff)\n+\t\treturn false;\n+\n \t/* If we don't have the whole header, drop packet. */\n \tth = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);\n \tif (th == NULL)\n", "prefixes": [ "net", "10/14" ] }