Re: [PATCH 2/2 nf v2] netfilter: xtables: fix L4 header parsing for non-first fragments

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Mon, Apr 20, 2026 at 10:45:41PM +0200, Pablo Neira Ayuso wrote:
> Hi Fernando,
> 
> On Mon, Apr 20, 2026 at 12:47:45PM +0200, Fernando Fernandez Mancera wrote:
> > diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
> > index 76e01f292aaf..d366e294f1aa 100644
> > --- a/net/netfilter/xt_socket.c
> > +++ b/net/netfilter/xt_socket.c
> > @@ -55,8 +55,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
> >  	if (sk && !net_eq(xt_net(par), sock_net(sk)))
> >  		sk = NULL;
> >  
> > -	if (!sk)
> > +	if (!sk) {
> > +		if (par->fragoff)
> > +			return false;
> >  		sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
> > +	}
> >  
> >  	if (sk) {
> >  		bool wildcard;
> > @@ -116,8 +119,11 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
> >  	if (sk && !net_eq(xt_net(par), sock_net(sk)))
> >  		sk = NULL;
> >  
> > -	if (!sk)
> > +	if (!sk) {
> > +		if (par->fragoff)
> > +			return false;
> 
> Your patch will work as intented in iptables over nf_tables, because
> it always sets on fragoff regardless user policy.
> 
> But, if ipv6_find_hdr() finds no layer 4 protocol, then fragoff
> remains zero, and pkt->flags does not set on NFT_PKTINFO_L4PROTO.
> There, in nftables, par->fragoff but itself is not reliable because
> maybe the layer 4 was not found.

This is where pkt->tprot comes into play. I think this series is fine
with nf_tables, it is just ip6_tables legacy that lags behind.

> Then, there is ip6_tables legacy which does not behave like ip_tables
> for fragments.
> 
> ip6t_do_table() only sets fragoff if IP6T_F_PROTO (-p in userspace) is
> used, unlike nftables which always sets on fragoff.
> 
> So par->fragoff is unreliable in ip6_tables legacy, and
> ipv6_find_hdr() is called over and over again ip6_packet_match() loop
> for each rule.
> 
> One way would be to call ipv6_find_hdr() inconditionally from
> ip6_tables legacy, but that belongs to a different patch and that
> would be touch core ip6_tables legacy.
> 
> Rewinding a bit, coming to back to the original issue: osf only
> supports ipv4 :-)
> 
> >  		sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
> > +	}
> >  
> >  	if (sk) {
> >  		bool wildcard;
> > diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
> > index 0d32d4841cb3..69844cc8dbb8 100644
> > --- a/net/netfilter/xt_tcpmss.c
> > +++ b/net/netfilter/xt_tcpmss.c
> > @@ -32,6 +32,9 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >  	u8 _opt[15 * 4 - sizeof(_tcph)];
> >  	unsigned int i, optlen;
> >  
> > +	if (par->fragoff)
> > +		return false;
> > +
> >  	/* If we don't have the whole header, drop packet. */
> >  	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
> >  	if (th == NULL)
> > -- 
> > 2.53.0
> >