Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2223979/?format=api
{ "id": 2223979, "url": "http://patchwork.ozlabs.org/api/patches/2223979/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260416131453.308611-2-pablo@netfilter.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260416131453.308611-2-pablo@netfilter.org>", "list_archive_url": null, "date": "2026-04-16T13:14:43", "name": "[net,01/11] netfilter: arp_tables: fix IEEE1394 ARP payload parsing in arp_packet_match()", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "bcda2d266df2a0edfbb93b3254262cbbd8ef5b07", "submitter": { "id": 1315, "url": "http://patchwork.ozlabs.org/api/people/1315/?format=api", "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org" }, "delegate": { "id": 11902, "url": "http://patchwork.ozlabs.org/api/users/11902/?format=api", "username": "strlen", "first_name": "Florian", "last_name": "Westphal", "email": "fw@strlen.de" }, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260416131453.308611-2-pablo@netfilter.org/mbox/", "series": [ { "id": 500161, "url": "http://patchwork.ozlabs.org/api/series/500161/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500161", "date": "2026-04-16T13:14:48", "name": "[net,01/11] netfilter: arp_tables: fix IEEE1394 ARP payload parsing in arp_packet_match()", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500161/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2223979/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2223979/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11969-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=NgZPu9kl;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c04:e001:36c::12fc:5321; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11969-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"NgZPu9kl\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org" ], "Received": [ "from tor.lore.kernel.org (tor.lore.kernel.org\n [IPv6:2600:3c04:e001:36c::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxJTd2W6Pz1yG9\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 16 Apr 2026 23:17:41 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id 347D7313A203\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 16 Apr 2026 13:15:16 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id AD1D43C1973;\n\tThu, 16 Apr 2026 13:15:05 +0000 (UTC)", "from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id B189C3BD246;\n\tThu, 16 Apr 2026 13:15:03 +0000 (UTC)", "from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id 51F4060253;\n\tThu, 16 Apr 2026 15:15:01 +0200 (CEST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776345305; cv=none;\n b=Ww9l7LK91gHr+FZacMXaGh4HPiR/sZ1L3R6/5R9BL/oPA/Pt2AHhSaa3pMV3XqRLuIzSkvK1vW4jjzsAJeUwaP+ioK3Ymt/udrMwVrb5/soz8FDhy413pBJDHPTNbnDD1sXDJU/ZsHzp14908SVauWImnoM5nQlwca1E8JNEXAc=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776345305; c=relaxed/simple;\n\tbh=E+TqY3nur+I/j7EktcUsc/tC9j0NrLrhL7r3Z7S4k0Q=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=iCtaNXMtoZq415nenhB0EQoKhwgydXLHV6Y3gtMDBK4b60vHTTg5BtFp1HhWfX/eA3E1vGPwu30V6k9YumVvfIxBkuoqExXYaJaR3Lhxoj0XcOoQzp76vI+DkOTmLB+o/EnJLid9IDxQy7wnNKdbow9dPEggR9z5lAPM7bak+Y0=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=NgZPu9kl; arc=none smtp.client-ip=217.70.190.124", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1776345301;\n\tbh=UKA+A3aFYBFFgnZcbNAbiR56Du+bLjEnS3Riajgl8fg=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=NgZPu9klyq8xsRfNTXWB/oar9AdUGeNFczkn5IWtOiSMtBhJdeE8Ft46z1BpGeiSv\n\t 9JoNTyWRavFYK4QSbXW61SPS2maOkzqC2XEXKOyJqZkMKf8KrmesV5ii32QbmTb/PS\n\t GnBJYR8Hib1iYhom2JzprK7CyHQKRBDzWriLgnppWPjMVNz51WlynUa9FopsVGSYQJ\n\t BPMatb7MOsm09gSGNz2kiZmg+qTd+8o0PNuFYSZj72fuPj9SRBLz8cYfDeSYEoKcTC\n\t sc73LIrCE1jrRzSd7JSOeNk4QmDjesac0EOihgriHwbocZ4Jk+qfCle0+BRSf8nAYt\n\t AnRas55T9RX7g==", "From": "Pablo Neira Ayuso <pablo@netfilter.org>", "To": "netfilter-devel@vger.kernel.org", "Cc": "davem@davemloft.net,\n\tnetdev@vger.kernel.org,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tedumazet@google.com,\n\tfw@strlen.de,\n\thorms@kernel.org", "Subject": "[PATCH net 01/11] netfilter: arp_tables: fix IEEE1394 ARP payload\n parsing in arp_packet_match()", "Date": "Thu, 16 Apr 2026 15:14:43 +0200", "Message-ID": "<20260416131453.308611-2-pablo@netfilter.org>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<20260416131453.308611-1-pablo@netfilter.org>", "References": "<20260416131453.308611-1-pablo@netfilter.org>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "From: Weiming Shi <bestswngs@gmail.com>\n\narp_packet_match() unconditionally parses the ARP payload assuming two\nhardware addresses are present (source and target). However,\nIPv4-over-IEEE1394 ARP (RFC 2734) omits the target hardware address\nfield, and arp_hdr_len() already accounts for this by returning a\nshorter length for ARPHRD_IEEE1394 devices.\n\nAs a result, on IEEE1394 interfaces arp_packet_match() advances past a\nnonexistent target hardware address and reads the wrong bytes for both\nthe target device address comparison and the target IP address. This\ncauses arptables rules to match against garbage data, leading to\nincorrect filtering decisions: packets that should be accepted may be\ndropped and vice versa.\n\nThe ARP stack in net/ipv4/arp.c (arp_create and arp_process) already\nhandles this correctly by skipping the target hardware address for\nARPHRD_IEEE1394. Apply the same pattern to arp_packet_match().\n\n[ Pablo has mangled this patch to include Simon Horman's suggestions ]\n\nFixes: 6752c8db8e0c (\"firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.\")\nReported-by: Xiang Mei <xmei5@asu.edu>\nSigned-off-by: Weiming Shi <bestswngs@gmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/ipv4/netfilter/arp_tables.c | 14 +++++++++++---\n 1 file changed, 11 insertions(+), 3 deletions(-)", "diff": "diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c\nindex 1cdd9c28ab2d..a7a56890b5b5 100644\n--- a/net/ipv4/netfilter/arp_tables.c\n+++ b/net/ipv4/netfilter/arp_tables.c\n@@ -110,13 +110,21 @@ static inline int arp_packet_match(const struct arphdr *arphdr,\n \tarpptr += dev->addr_len;\n \tmemcpy(&src_ipaddr, arpptr, sizeof(u32));\n \tarpptr += sizeof(u32);\n-\ttgt_devaddr = arpptr;\n-\tarpptr += dev->addr_len;\n+\n+\tif (IS_ENABLED(CONFIG_FIREWIRE_NET) && dev->type == ARPHRD_IEEE1394) {\n+\t\ttgt_devaddr = NULL;\n+\t} else {\n+\t\ttgt_devaddr = arpptr;\n+\t\tarpptr += dev->addr_len;\n+\t}\n \tmemcpy(&tgt_ipaddr, arpptr, sizeof(u32));\n \n \tif (NF_INVF(arpinfo, ARPT_INV_SRCDEVADDR,\n \t\t arp_devaddr_compare(&arpinfo->src_devaddr, src_devaddr,\n-\t\t\t\t\tdev->addr_len)) ||\n+\t\t\t\t\tdev->addr_len)))\n+\t\treturn 0;\n+\n+\tif (tgt_devaddr &&\n \t NF_INVF(arpinfo, ARPT_INV_TGTDEVADDR,\n \t\t arp_devaddr_compare(&arpinfo->tgt_devaddr, tgt_devaddr,\n \t\t\t\t\tdev->addr_len)))\n", "prefixes": [ "net", "01/11" ] }