[{"id":3678950,"web_url":"http://patchwork.ozlabs.org/comment/3678950/","msgid":"","list_archive_url":null,"date":"2026-04-18T07:28:05","subject":"Re: [PATCH nf] netfilter: arp_tables: fix IEEE1394 ARP payload\n mangling","submitter":{"id":1315,"url":"http://patchwork.ozlabs.org/api/people/1315/","name":"Pablo Neira Ayuso","email":"pablo@netfilter.org"},"content":"Hi Florian,\n\nOn Fri, Apr 17, 2026 at 03:19:05PM +0200, Florian Westphal wrote:\n> sashiko.dev noticed that similar bug pattern exists in arpt_mangle:\n> \"IEEE1394 ARP payloads omit the target hardware address, advancing\n> arpptr by hln after the source IP address skips over the actual target\n> IP address.\"\n> \n> Apply similar fix: check dev->type. If we're asked to mangle what\n> doesn't exist, drop the packet.\n\nI included a fix for this in:\n\nhttps://patchwork.kernel.org/project/netdevbpf/patch/20260417091422.342615-1-pablo@netfilter.org/\n\nI forgot to mangle the patch title though to:\n\n netfilter: arp_tables: fix IEEE1394 ARP payload parsing\n\n> Fixes: 6752c8db8e0c (\"firewire net, ipv4 arp: Extend hardware address and remove driver-level packet inspection.\")\n> Signed-off-by: Florian Westphal \n> ---\n> Collides with a inflight patch.\n\nAre you referring to the patch I made?\n\n> I'll rebase or discard depending on what netdev@ does.\n> \n> net/ipv4/netfilter/arpt_mangle.c | 23 ++++++++++++++++++++++-\n> 1 file changed, 22 insertions(+), 1 deletion(-)\n> \n> diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c\n> index a4e07e5e9c11..5a3560e1b59b 100644\n> --- a/net/ipv4/netfilter/arpt_mangle.c\n> +++ b/net/ipv4/netfilter/arpt_mangle.c\n> @@ -13,6 +13,7 @@ static unsigned int\n> target(struct sk_buff *skb, const struct xt_action_param *par)\n> {\n> \tconst struct arpt_mangle *mangle = par->targinfo;\n> +\tbool has_tgt_devaddr = true;\n> \tconst struct arphdr *arp;\n> \tunsigned char *arpptr;\n> \tint pln, hln;\n> @@ -39,13 +40,33 @@ target(struct sk_buff *skb, const struct xt_action_param *par)\n> \t\tmemcpy(arpptr, &mangle->u_s.src_ip, pln);\n> \t}\n> \tarpptr += pln;\n> +\n> +\tif (IS_ENABLED(CONFIG_FIREWIRE_NET)) {\n> +\t\tconst struct net_device *dev = skb->dev;\n> +\n> +\t\tif (!dev) {\n> +\t\t\t/* can't munge without arphrd type. */\n> +\t\t\tif (mangle->flags & (ARPT_MANGLE_TDEV|ARPT_MANGLE_TIP))\n> +\t\t\t\treturn NF_DROP;\n> +\t\t\treturn mangle->target;\n> +\t\t}\n> +\n> +\t\tif (dev->type == ARPHRD_IEEE1394)\n> +\t\t\thas_tgt_devaddr = false;\n> +\t}\n> +\n> \tif (mangle->flags & ARPT_MANGLE_TDEV) {\n> +\t\tif (!has_tgt_devaddr)\n> +\t\t\treturn NF_DROP;\n> +\n> \t\tif (ARPT_DEV_ADDR_LEN_MAX < hln ||\n> \t\t (arpptr + hln > skb_tail_pointer(skb)))\n> \t\t\treturn NF_DROP;\n> \t\tmemcpy(arpptr, mangle->tgt_devaddr, hln);\n> \t}\n> -\tarpptr += hln;\n> +\tif (has_tgt_devaddr)\n> +\t\tarpptr += hln;\n> +\n> \tif (mangle->flags & ARPT_MANGLE_TIP) {\n> \t\tif (ARPT_MANGLE_ADDR_LEN_MAX < pln ||\n> \t\t (arpptr + pln > skb_tail_pointer(skb)))\n> -- \n> 2.52.0\n> \n>","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=G/XkuYNg;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12009-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"G/XkuYNg\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fyNpK3ZGTz1yDF\n\tfor ; Sat, 18 Apr 2026 17:35:53 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 4938C302FA87\n\tfor ; Sat, 18 Apr 2026 07:35:26 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id E047D332610;\n\tSat, 18 Apr 2026 07:35:25 +0000 (UTC)","from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id B34D012B94\n\tfor ; Sat, 18 Apr 2026 07:35:22 +0000 (UTC)","from netfilter.org (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with UTF8SMTPSA id B5A4760177;\n\tSat, 18 Apr 2026 09:28:07 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776497725; cv=none;\n b=DPMrUzZeYuu7fYRcjf9+UNY9XS9Rq/ofnEeNoCsAPh2s7ZmDYYPnbbUT7IsHRKwqwV2xiDTXRsJLBvvQtdEjI7KsQvfK4G9jEoPZ4fIB6hg6Qap2UjrPXZs0/ISGHlL4AgHaqOEXnT2gjys8Ot1YMOWywVY92suksUUzuIiC4MY=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776497725; c=relaxed/simple;\n\tbh=Cf/pJrTZLEiAV616Nmw9XUtngQdekDMLt/ow+U9z+VA=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=K2V0OL0G8RPihtXhAF3HGy31BGOkwc7opqTQr8RIKdkTIb6SET0+/kDF3HLBXloWrdAep8AVsGyGuE7CUxfW+epg/ThHJgM4bBibe2Q/tciLuOPokUPmgpH+9q+mNLl5BKZoMuXOg1odrZFoYCCoSUYrad/ZNzRdg+l6TMxbzfg=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=G/XkuYNg; arc=none smtp.client-ip=217.70.190.124","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1776497287;\n\tbh=2xmlsraU38wls5r3dWhGbOWtCifRuAxGsJm3ose5Zxo=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=G/XkuYNgq7WlKQX2BDhNe2GD8TbKRV2Zo5KmGzIJKgvYqejQMBhPLBUKIm8YSyn7J\n\t 0excfr3bBOfMjfRowYeFN2pzqI9evzZGE5ygBoL2t55dk+6LjSmcdOXWPsvnWf3aNc\n\t OXrUK0BXPSpDTzpKlfC1sCOb/tjbvGYpy+nzzw+we7IrnZBne0yZkZvXCeCNERMTXs\n\t /kzr4dV7SGDH/Bz9V//5gomih+J1s0P+MpXGPZoeht3Ry4Qmts8lhLEzscoSzBEKE0\n\t ot3vw1YEWiXs5thYC1fhFMkQ/jBTcsJKk/nXag/kBljjcI9qOkxmdPcC+1RDAxuDKG\n\t gOLHcYDtQN70w==","Date":"Sat, 18 Apr 2026 09:28:05 +0200","From":"Pablo Neira Ayuso ","To":"Florian Westphal ","Cc":"netfilter-devel@vger.kernel.org","Subject":"Re: [PATCH nf] netfilter: arp_tables: fix IEEE1394 ARP payload\n mangling","Message-ID":"","References":"<20260417131910.17932-1-fw@strlen.de>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20260417131910.17932-1-fw@strlen.de>"}},{"id":3678956,"web_url":"http://patchwork.ozlabs.org/comment/3678956/","msgid":"","list_archive_url":null,"date":"2026-04-18T08:10:24","subject":"Re: [PATCH nf] netfilter: arp_tables: fix IEEE1394 ARP payload\n mangling","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/people/1025/","name":"Florian Westphal","email":"fw@strlen.de"},"content":"Pablo Neira Ayuso wrote:\n> Hi Florian,\n> \n> On Fri, Apr 17, 2026 at 03:19:05PM +0200, Florian Westphal wrote:\n> > sashiko.dev noticed that similar bug pattern exists in arpt_mangle:\n> > \"IEEE1394 ARP payloads omit the target hardware address, advancing\n> > arpptr by hln after the source IP address skips over the actual target\n> > IP address.\"\n> > \n> > Apply similar fix: check dev->type. If we're asked to mangle what\n> > doesn't exist, drop the packet.\n> \n> I included a fix for this in:\n> \n> https://patchwork.kernel.org/project/netdevbpf/patch/20260417091422.342615-1-pablo@netfilter.org/\n\nI saw that *after* I had made this patch.\n\n> > Collides with a inflight patch.\n> \n> Are you referring to the patch I made?\n\nYes.","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12014-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=strlen.de"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fyPZM1601z1y1V\n\tfor ; Sat, 18 Apr 2026 18:10:35 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 80B9030247D6\n\tfor ; Sat, 18 Apr 2026 08:10:30 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 8410F371898;\n\tSat, 18 Apr 2026 08:10:29 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 493592459D4\n\tfor ; Sat, 18 Apr 2026 08:10:27 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid 0561F606C8; Sat, 18 Apr 2026 10:10:24 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776499829; cv=none;\n b=Pa1lhbq2oIOuJiI7c9HzhNXYKphkEJ1GppGx8r3w9m/REDlde6JvAAb2Tp253TkiVdDS5BJkFe9IjTEc2rWwIjpsesaEpv+FYST5tS7Bj6RmcWzU94a76ZEvOtncjQEFH5vULH/MO5X8wUqpLh6aOOCzGJuuVLvuTFOtyYq2GnU=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776499829; c=relaxed/simple;\n\tbh=0wdDdKJHkWmxxFgFnl9WrzrVLehDxuMRY7UBT5FbG6k=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=K9PpIJQfluSxtanfSsgp2gMDKTP42KzK7Cu46zY7v/DGnI15KaypkgdxYc6bz789EiogUWGvP+URROMyQPyD4b2n0aToQiitDotl//r6fXXdiSsDDmOJjq/kTZO2adfjSVLUGx9BijItxv57sBkDDFoWYGzC+95yHFzkJ7cw0Yo=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=strlen.de; arc=none smtp.client-ip=91.216.245.30","Date":"Sat, 18 Apr 2026 10:10:24 +0200","From":"Florian Westphal ","To":"Pablo Neira Ayuso ","Cc":"netfilter-devel@vger.kernel.org","Subject":"Re: [PATCH nf] netfilter: arp_tables: fix IEEE1394 ARP payload\n mangling","Message-ID":"","References":"<20260417131910.17932-1-fw@strlen.de>\n ","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":""}}]