Re: xtables-addons: ipp2p does not block TCP traffic with nonlinear skb

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, May 31, 2023 at 11:41:07AM +0200, Jan Engelhardt wrote:
> 
> On Wednesday 2023-05-31 08:42, ValdikSS wrote:
> > However, it's not getting processed due to nonlinear skb:
> >
> >> static bool
> >> ipp2p_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >>  /* make sure that skb is linear */
> >>  if (skb_is_nonlinear(skb)) {
> >>   if (info->debug)
> >>   	printk("IPP2P.match: nonlinear skb found\n");
> >>  	return 0;
> >>  }
> 
> It should be possible to just take the code from xt_ECHO and call
> 
> if (skb_linearize(skb) < 0)
> 	return false;
> 
> However, none of the xtables matches in the Linux kernel do this linearization,
> at least not that I can see directly. Or xt_string's call to skb_find_text is
> magic..

skb_find_text() deals with non-linear skbuff, see skb_seq_read().