[PATCH] netfilter: nft_ct: validate timeout object protocol

[PATCH] netfilter: nft_ct: validate timeout object protocol

[Kyle Zeng]

nft_ct_timeout_obj_eval() only compares the timeout object protocol with
packet metadata. A packet header can be changed after conntrack attaches
an entry, so this metadata does not necessarily describe the entry.

Timeout objects contain protocol-specific arrays. Attaching an object for
a protocol with fewer timeout states to an entry for one with more states
lets the conntrack tracker read beyond the object.

Require the object protocol to match the conntrack tuple protocol before
attaching it. This mirrors validation by named timeout policies and
nftables conntrack helper objects.

Fixes: 0434ccdcf883 ("netfilter: nf_tables: rework ct timeout set support")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 net/netfilter/nft_ct.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 03a88c7..d618bfa 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -885,7 +885,8 @@ static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 	if (priv->l4proto != pkt->tprot)
 		return;
 
-	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
+	if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct) ||
+	    priv->l4proto != nf_ct_protonum(ct))
 		return;
 
 	timeout = nf_ct_timeout_find(ct);

Re: [PATCH] netfilter: nft_ct: validate timeout object protocol

[Florian Westphal]

Kyle Zeng <kylebot@openai.com> wrote:
> nft_ct_timeout_obj_eval() only compares the timeout object protocol with
> packet metadata. A packet header can be changed after conntrack attaches
> an entry, so this metadata does not necessarily describe the entry.

I think all of these patches are wrong.  *How* can a packet header
change?  And if so, why is it enough to compare with the ct?

And why is that enough to somehow make it safe?

Are you going to add checks everywhere?