Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 2224691,
    "url": "http://patchwork.ozlabs.org/api/patches/2224691/?format=api",
    "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417183433.4739-2-fmancera@suse.de/",
    "project": {
        "id": 26,
        "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api",
        "name": "Netfilter Development",
        "link_name": "netfilter-devel",
        "list_id": "netfilter-devel.vger.kernel.org",
        "list_email": "netfilter-devel@vger.kernel.org",
        "web_url": null,
        "scm_url": null,
        "webscm_url": null,
        "list_archive_url": "",
        "list_archive_url_format": "",
        "commit_url_format": ""
    },
    "msgid": "<20260417183433.4739-2-fmancera@suse.de>",
    "list_archive_url": null,
    "date": "2026-04-17T18:34:31",
    "name": "[2/4,nf] netfilter: nft_tproxy: skip evaluation for non-first fragments",
    "commit_ref": null,
    "pull_url": null,
    "state": "changes-requested",
    "archived": false,
    "hash": "3af4dd0ff46294be35926188c7b0cb7c76673e4b",
    "submitter": {
        "id": 90904,
        "url": "http://patchwork.ozlabs.org/api/people/90904/?format=api",
        "name": "Fernando Fernandez Mancera",
        "email": "fmancera@suse.de"
    },
    "delegate": null,
    "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260417183433.4739-2-fmancera@suse.de/mbox/",
    "series": [
        {
            "id": 500386,
            "url": "http://patchwork.ozlabs.org/api/series/500386/?format=api",
            "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=500386",
            "date": "2026-04-17T18:34:31",
            "name": "[1/4,nf] netfilter: nft_exthdr: skip SCTP chunk evaluation for non-first fragments",
            "version": 1,
            "mbox": "http://patchwork.ozlabs.org/series/500386/mbox/"
        }
    ],
    "comments": "http://patchwork.ozlabs.org/api/patches/2224691/comments/",
    "check": "pending",
    "checks": "http://patchwork.ozlabs.org/api/patches/2224691/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "\n <netfilter-devel+bounces-12005-incoming=patchwork.ozlabs.org@vger.kernel.org>",
        "X-Original-To": [
            "incoming@patchwork.ozlabs.org",
            "netfilter-devel@vger.kernel.org"
        ],
        "Delivered-To": "patchwork-incoming@legolas.ozlabs.org",
        "Authentication-Results": [
            "legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256\n header.s=susede2_rsa header.b=wRq7R5mn;\n\tdkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=dHOeASAm;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.a=rsa-sha256 header.s=susede2_rsa header.b=wRq7R5mn;\n\tdkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=dHOeASAm;\n\tdkim-atps=neutral",
            "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12005-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)",
            "smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"wRq7R5mn\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"dHOeASAm\";\n\tdkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"wRq7R5mn\";\n\tdkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=\"dHOeASAm\"",
            "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=195.135.223.130",
            "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de",
            "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=suse.de",
            "smtp-out1.suse.de;\n\tnone"
        ],
        "Received": [
            "from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fy3TX4dcbz1yCv\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 18 Apr 2026 04:35:12 +1000 (AEST)",
            "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 43D71300D377\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 18:35:09 +0000 (UTC)",
            "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id D93B53A6B61;\n\tFri, 17 Apr 2026 18:35:06 +0000 (UTC)",
            "from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E864352F85\n\tfor <netfilter-devel@vger.kernel.org>; Fri, 17 Apr 2026 18:35:03 +0000 (UTC)",
            "from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby smtp-out1.suse.de (Postfix) with ESMTPS id 806666A9EA;\n\tFri, 17 Apr 2026 18:34:58 +0000 (UTC)",
            "from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n\t(No client certificate requested)\n\tby imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 15C16593AE;\n\tFri, 17 Apr 2026 18:34:58 +0000 (UTC)",
            "from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n\tby imap1.dmz-prg2.suse.org with ESMTPSA\n\tid SC6RAlJ94mmFFQAAD6G6ig\n\t(envelope-from <fmancera@suse.de>); Fri, 17 Apr 2026 18:34:58 +0000"
        ],
        "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1776450906; cv=none;\n b=GP/D3xDfDTPtl1WsTPVGzWUcNfoonbEMLCYyq7nA3AUAWcxTNrUoSA+3QgxYcs2IGlqNK702Z9g21VL+SshAP15V9R7oG+mbuakD21vqxz7rB1Jo2H5+KqocirahwFBCTgLbchsheMOFqYC52DVdTW+9UxcuD5AlvOo91Ypdjok=",
        "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1776450906; c=relaxed/simple;\n\tbh=+RTYkB2m0cRxNY4pT8RzwxBCKN+3BoFBk1EtIQdEJoI=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=FSMJIF3k/FNKMdHWG9W5OTYf6wgJ2QaYfjota+gEAM4aSaXoyQQLBsHfgwhlBlWE43ENYitpuaHaH+LIbi5j93NPzIC8tEml71e4rMGN7vFAdMMe64Ltr2GB1mlgF0S5LKj0Ph8amcNBhm5XKKaYoz3mPrUrS2wUP43mN6qN3xk=",
        "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=suse.de;\n spf=pass smtp.mailfrom=suse.de;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=wRq7R5mn;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=dHOeASAm;\n dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de\n header.b=wRq7R5mn;\n dkim=permerror (0-bit key) header.d=suse.de header.i=@suse.de\n header.b=dHOeASAm; arc=none smtp.client-ip=195.135.223.130",
        "DKIM-Signature": [
            "v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776450898;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=YmRkp/3WVgIPmEM1j+91qLo1hAzTf+aJ86Bsu9R/Ex4=;\n\tb=wRq7R5mnKdmr81Lmpe48/rumdC7cVflibpkeOH+beE5WM1AR3UdzUFJy9yeheePaUy57wh\n\tqMfyGdbwDeEy7gSsgvRutVQDJMXuY/1XYg572f86P1PDc+XMMqChoZfTnZb3/WIbdoGeog\n\t8BktGW1tJpx2GfDvF//NWs6m42YP18w=",
            "v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776450898;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=YmRkp/3WVgIPmEM1j+91qLo1hAzTf+aJ86Bsu9R/Ex4=;\n\tb=dHOeASAmRoFp15DSeF95rnX8CvLOK+oxa3NSEtXssc/J32c88c0lU5HxGFX83QyqiueATM\n\tErIeD0neuUGUfhCQ==",
            "v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de;\n s=susede2_rsa;\n\tt=1776450898;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=YmRkp/3WVgIPmEM1j+91qLo1hAzTf+aJ86Bsu9R/Ex4=;\n\tb=wRq7R5mnKdmr81Lmpe48/rumdC7cVflibpkeOH+beE5WM1AR3UdzUFJy9yeheePaUy57wh\n\tqMfyGdbwDeEy7gSsgvRutVQDJMXuY/1XYg572f86P1PDc+XMMqChoZfTnZb3/WIbdoGeog\n\t8BktGW1tJpx2GfDvF//NWs6m42YP18w=",
            "v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;\n\ts=susede2_ed25519; t=1776450898;\n\th=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n\t mime-version:mime-version:\n\t content-transfer-encoding:content-transfer-encoding:\n\t in-reply-to:in-reply-to:references:references;\n\tbh=YmRkp/3WVgIPmEM1j+91qLo1hAzTf+aJ86Bsu9R/Ex4=;\n\tb=dHOeASAmRoFp15DSeF95rnX8CvLOK+oxa3NSEtXssc/J32c88c0lU5HxGFX83QyqiueATM\n\tErIeD0neuUGUfhCQ=="
        ],
        "From": "Fernando Fernandez Mancera <fmancera@suse.de>",
        "To": "netfilter-devel@vger.kernel.org",
        "Cc": "netdev@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\tpablo@netfilter.org,\n\tfw@strlen.de,\n\tphil@nwl.cc,\n\tFernando Fernandez Mancera <fmancera@suse.de>",
        "Subject": "[PATCH 2/4 nf] netfilter: nft_tproxy: skip evaluation for non-first\n fragments",
        "Date": "Fri, 17 Apr 2026 20:34:31 +0200",
        "Message-ID": "<20260417183433.4739-2-fmancera@suse.de>",
        "X-Mailer": "git-send-email 2.51.0",
        "In-Reply-To": "<20260417183433.4739-1-fmancera@suse.de>",
        "References": "<20260417183433.4739-1-fmancera@suse.de>",
        "Precedence": "bulk",
        "X-Mailing-List": "netfilter-devel@vger.kernel.org",
        "List-Id": "<netfilter-devel.vger.kernel.org>",
        "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>",
        "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>",
        "MIME-Version": "1.0",
        "Content-Transfer-Encoding": "8bit",
        "X-Spam-Score": "-2.80",
        "X-Spam-Level": "",
        "X-Spamd-Result": "default: False [-2.80 / 50.00];\n\tBAYES_HAM(-3.00)[99.99%];\n\tMID_CONTAINS_FROM(1.00)[];\n\tNEURAL_HAM_LONG(-1.00)[-1.000];\n\tR_MISSING_CHARSET(0.50)[];\n\tNEURAL_HAM_SHORT(-0.20)[-0.996];\n\tMIME_GOOD(-0.10)[text/plain];\n\tFUZZY_RATELIMITED(0.00)[rspamd.com];\n\tRCPT_COUNT_SEVEN(0.00)[7];\n\tMIME_TRACE(0.00)[0:+];\n\tARC_NA(0.00)[];\n\tRCVD_VIA_SMTP_AUTH(0.00)[];\n\tDKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519];\n\tURIBL_BLOCKED(0.00)[imap1.dmz-prg2.suse.org:helo,suse.de:mid,suse.de:email];\n\tFROM_EQ_ENVFROM(0.00)[];\n\tFROM_HAS_DN(0.00)[];\n\tTO_DN_SOME(0.00)[];\n\tRCVD_COUNT_TWO(0.00)[2];\n\tTO_MATCH_ENVRCPT_ALL(0.00)[];\n\tDBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo,suse.de:mid,suse.de:email];\n\tRCVD_TLS_ALL(0.00)[]",
        "X-Spam-Flag": "NO"
    },
    "content": "The tproxy expression relies on L4 ports to perform socke lookups. For\nfragmented packets, every fragment carries the transport protocol used\nbut only the first fragment contains the L4 header.\n\nAs nftables is not evaluating chain priority, a tproxy expression could\nbe attached to a PREROUTING chain with a priority lower than -400. This\nwould bypass defragmentation.\n\nAdd a check for pkt->fragoff to ensure tproxy only evaluates\nunfragmented packets or the first fragment in the stream.\n\nFixes: 4ed8eb6570a4 (\"netfilter: nf_tables: Add native tproxy support\")\nSigned-off-by: Fernando Fernandez Mancera <fmancera@suse.de>\n---\n net/netfilter/nft_tproxy.c | 8 ++++----\n 1 file changed, 4 insertions(+), 4 deletions(-)",
    "diff": "diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c\nindex 50481280abd2..8080cbd878cd 100644\n--- a/net/netfilter/nft_tproxy.c\n+++ b/net/netfilter/nft_tproxy.c\n@@ -30,8 +30,8 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,\n \t__be16 tport = 0;\n \tstruct sock *sk;\n \n-\tif (pkt->tprot != IPPROTO_TCP &&\n-\t    pkt->tprot != IPPROTO_UDP) {\n+\tif ((pkt->tprot != IPPROTO_TCP &&\n+\t     pkt->tprot != IPPROTO_UDP) || pkt->fragoff) {\n \t\tregs->verdict.code = NFT_BREAK;\n \t\treturn;\n \t}\n@@ -97,8 +97,8 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,\n \n \tmemset(&taddr, 0, sizeof(taddr));\n \n-\tif (pkt->tprot != IPPROTO_TCP &&\n-\t    pkt->tprot != IPPROTO_UDP) {\n+\tif ((pkt->tprot != IPPROTO_TCP &&\n+\t     pkt->tprot != IPPROTO_UDP) || pkt->fragoff) {\n \t\tregs->verdict.code = NFT_BREAK;\n \t\treturn;\n \t}\n",
    "prefixes": [
        "2/4",
        "nf"
    ]
}