All of lore.kernel.org
 help / color / mirror / Atom feed
From: patchwork-bot+netdevbpf@kernel.org
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org, davem@davemloft.net,
	netdev@vger.kernel.org, kuba@kernel.org, pabeni@redhat.com,
	edumazet@google.com, fw@strlen.de
Subject: Re: [PATCH net 1/2] netfilter: nf_tables: restore IP sanity checks for netdev/egress
Date: Thu, 29 Aug 2024 09:50:25 +0000	[thread overview]
Message-ID: <172492502535.1887808.17550387443774732604.git-patchwork-notify@kernel.org> (raw)
In-Reply-To: <20240828214708.619261-2-pablo@netfilter.org>

Hello:

This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:

On Wed, 28 Aug 2024 23:47:07 +0200 you wrote:
> Subtract network offset to skb->len before performing IPv4 header sanity
> checks, then adjust transport offset from offset from mac header.
> 
> Jorge Ortiz says:
> 
> When small UDP packets (< 4 bytes payload) are sent from eth0,
> `meta l4proto udp` condition is not met because `NFT_PKTINFO_L4PROTO` is
> not set. This happens because there is a comparison that checks if the
> transport header offset exceeds the total length.  This comparison does
> not take into account the fact that the skb network offset might be
> non-zero in egress mode (e.g., 14 bytes for Ethernet header).
> 
> [...]

Here is the summary with links:
  - [net,1/2] netfilter: nf_tables: restore IP sanity checks for netdev/egress
    https://git.kernel.org/netdev/net/c/5fd062891897
  - [net,2/2] netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation
    https://git.kernel.org/netdev/net/c/70c261d50095

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



  reply	other threads:[~2024-08-29  9:50 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-08-28 21:47 [PATCH net 0/2] Netfilter fixes for net Pablo Neira Ayuso
2024-08-28 21:47 ` [PATCH net 1/2] netfilter: nf_tables: restore IP sanity checks for netdev/egress Pablo Neira Ayuso
2024-08-29  9:50   ` patchwork-bot+netdevbpf [this message]
2024-08-28 21:47 ` [PATCH net 2/2] netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=172492502535.1887808.17550387443774732604.git-patchwork-notify@kernel.org \
    --to=patchwork-bot+netdevbpf@kernel.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=fw@strlen.de \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.