{"id":2229488,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2229488/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260428095840.51961-7-pablo@netfilter.org/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/1.1/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260428095840.51961-7-pablo@netfilter.org>","date":"2026-04-28T09:58:37","name":"[net,6/8] netfilter: xt_policy: fix strict mode inbound policy matching","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"ccb09e96be13fd14e5477768d79b89fb83afa902","submitter":{"id":1315,"url":"http://patchwork.ozlabs.org/api/1.1/people/1315/?format=json","name":"Pablo Neira Ayuso","email":"pablo@netfilter.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260428095840.51961-7-pablo@netfilter.org/mbox/","series":[{"id":501814,"url":"http://patchwork.ozlabs.org/api/1.1/series/501814/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=501814","date":"2026-04-28T09:58:32","name":"[net,1/8] netfilter: arp_tables: fix IEEE1394 ARP payload parsing","version":1,"mbox":"http://patchwork.ozlabs.org/series/501814/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2229488/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2229488/checks/","tags":{},"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=OVxkaC2k;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12243-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"OVxkaC2k\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org"],"Received":["from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g4bWj5gHBz1xvV\n\tfor ; Tue, 28 Apr 2026 19:59:45 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id 12508301AF27\n\tfor ; Tue, 28 Apr 2026 09:59:30 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 02D783E276E;\n\tTue, 28 Apr 2026 09:59:00 +0000 (UTC)","from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id CE8F03E2759;\n\tTue, 28 Apr 2026 09:58:55 +0000 (UTC)","from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id F235960254;\n\tTue, 28 Apr 2026 11:58:53 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777370337; cv=none;\n b=j+TgDPEu5OkQaACxiaSLXMeKRekMwO0tlW9A6eIF71vUPNHpW/xL146tp7xCdf5SsadFF1NrfCiYfQXDFhfyLLjVa8/G0WZ4unZSzkOh5led1xlL0zhE921+DGjstA9Wj2DhQ7C8XWBAO/c0gSQ3TMF1EYkvSBr3L2kJAaROsQ0=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777370337; c=relaxed/simple;\n\tbh=028gpVSnt0h4/WQhaGMCn9U2LguktmS13hyrI6Ir5yU=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=UrOz0n1xQdDtFtI0h7YzJgaGnhAZIiSMLB/KhnWVuVE0XtjK+HuWPBw3MweUOfdiXv2AFY1XYlKcZN+Y3PLrXJd4k35wJdLm/oqZbcUzkxRvTFm929GUYJejbS5MFoJBVH3yi40InDAkWurXv28wO4L211xm6juseIF9nfHhYX4=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=OVxkaC2k; arc=none smtp.client-ip=217.70.190.124","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1777370334;\n\tbh=ATsz83rZMAw5OYOOuuCL9l+aXZu+YgWCziiIs7DSmG4=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=OVxkaC2kH5UJLZz7h0edA1yaxCawFiT/RLPtzA00q76pL+AoOSUZo9B8WUUua4w3e\n\t E/9tnvN+JZApTcRpBZCZo/+no9B/92Ph0wRW9g4yNHJVyoirutow9lZ52V6yjs1CB7\n\t U2l9Rxro3Q0QaAoZurJ1WxFb/+FXjx80nn0F6/6xTg2G0vvZURwku9vHgOyJ4Omd9x\n\t oO6OWFFnMqUuIBUc3CQpIFgptZCYScvIDvtp5ufOe+fL8uxJ3P/fKer+cnmgBDPObo\n\t 23fFnTBGq+CmzJPJ/WlXQIQXL7tNrMsGdW8efd3iH9RO1CWrQWZLKbJoLzO+LUu8Bc\n\t c2Nc+XvYH2XFA==","From":"Pablo Neira Ayuso ","To":"netfilter-devel@vger.kernel.org","Cc":"davem@davemloft.net,\n\tnetdev@vger.kernel.org,\n\tkuba@kernel.org,\n\tpabeni@redhat.com,\n\tedumazet@google.com,\n\tfw@strlen.de,\n\thorms@kernel.org","Subject":"[PATCH net 6/8] netfilter: xt_policy: fix strict mode inbound policy\n matching","Date":"Tue, 28 Apr 2026 11:58:37 +0200","Message-ID":"<20260428095840.51961-7-pablo@netfilter.org>","X-Mailer":"git-send-email 2.47.3","In-Reply-To":"<20260428095840.51961-1-pablo@netfilter.org>","References":"<20260428095840.51961-1-pablo@netfilter.org>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit"},"content":"From: Jiexun Wang \n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info->pol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently.\n\nFixes: c4b885139203 (\"[NETFILTER]: x_tables: replace IPv4/IPv6 policy match by address family independant version\")\nReported-by: Yuan Tan \nReported-by: Yifan Wu \nReported-by: Juefei Pu \nReported-by: Xin Liu \nSigned-off-by: Jiexun Wang \nSigned-off-by: Ren Wei \nAcked-by: Florian Westphal \nSigned-off-by: Pablo Neira Ayuso \n---\n net/netfilter/xt_policy.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)","diff":"diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c\nindex cb6e8279010a..b5fa65558318 100644\n--- a/net/netfilter/xt_policy.c\n+++ b/net/netfilter/xt_policy.c\n@@ -63,7 +63,7 @@ match_policy_in(const struct sk_buff *skb, const struct xt_policy_info *info,\n \t\treturn 0;\n \n \tfor (i = sp->len - 1; i >= 0; i--) {\n-\t\tpos = strict ? i - sp->len + 1 : 0;\n+\t\tpos = strict ? sp->len - i - 1 : 0;\n \t\tif (pos >= info->len)\n \t\t\treturn 0;\n \t\te = &info->pol[pos];\n","prefixes":["net","6/8"]}