[PATCH 1/2 nf v2] netfilter: nf_tables: skip L4 header parsing for non-first fragments

[PATCH 1/2 nf v2] netfilter: nf_tables: skip L4 header parsing for non-first fragments

[Fernando Fernandez Mancera]

The tproxy, osf, socket and exthdr (SCTP) expressions rely on the
presence of transport layer headers to perform socket lookups,
fingerprint matching, or chunk extraction. For fragmented packets, while
the IP protocol remains constant across all fragments, only the first
fragment contains the actual L4 header.

The expressions could be attached to a chain with a priority lower than
-400, bypassing defragmentation. Or could be used in stateless
environments where defragmentation is not happening at all.  This could
result in garbage data being used for the matching.

Add a check for pkt->fragoff so only unfragmented packets or the first
fragment is processed.

Fixes: 133dc203d77d ("netfilter: nft_exthdr: Support SCTP chunks")
Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support")
Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
v2: handled fragmented packets for socket expression too,
squashed nftables expression commits into this one.
---
 net/netfilter/nft_exthdr.c | 2 +-
 net/netfilter/nft_osf.c    | 2 +-
 net/netfilter/nft_socket.c | 7 ++++++-
 net/netfilter/nft_tproxy.c | 8 ++++----
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 7eedf4e3ae9c..8eb708bb8cff 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -376,7 +376,7 @@ static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
 	const struct sctp_chunkhdr *sch;
 	struct sctp_chunkhdr _sch;
 
-	if (pkt->tprot != IPPROTO_SCTP)
+	if (pkt->tprot != IPPROTO_SCTP || pkt->fragoff)
 		goto err;
 
 	do {
diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index 1c0b493ef0a9..ceca87e405eb 100644
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -28,7 +28,7 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,
 	struct nf_osf_data data;
 	struct tcphdr _tcph;
 
-	if (pkt->tprot != IPPROTO_TCP) {
+	if (pkt->tprot != IPPROTO_TCP || pkt->fragoff) {
 		regs->verdict.code = NFT_BREAK;
 		return;
 	}
diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index 36affbb697c2..52c9a9291486 100644
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -116,8 +116,13 @@ static void nft_socket_eval(const struct nft_expr *expr,
 	if (sk && !net_eq(nft_net(pkt), sock_net(sk)))
 		sk = NULL;
 
-	if (!sk)
+	if (!sk) {
+		if (pkt->fragoff) {
+			regs->verdict.code = NFT_BREAK;
+			return;
+		}
 		sk = nft_socket_do_lookup(pkt);
+	}
 
 	if (!sk) {
 		regs->verdict.code = NFT_BREAK;
diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
index 50481280abd2..8080cbd878cd 100644
--- a/net/netfilter/nft_tproxy.c
+++ b/net/netfilter/nft_tproxy.c
@@ -30,8 +30,8 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
 	__be16 tport = 0;
 	struct sock *sk;
 
-	if (pkt->tprot != IPPROTO_TCP &&
-	    pkt->tprot != IPPROTO_UDP) {
+	if ((pkt->tprot != IPPROTO_TCP &&
+	     pkt->tprot != IPPROTO_UDP) || pkt->fragoff) {
 		regs->verdict.code = NFT_BREAK;
 		return;
 	}
@@ -97,8 +97,8 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,
 
 	memset(&taddr, 0, sizeof(taddr));
 
-	if (pkt->tprot != IPPROTO_TCP &&
-	    pkt->tprot != IPPROTO_UDP) {
+	if ((pkt->tprot != IPPROTO_TCP &&
+	     pkt->tprot != IPPROTO_UDP) || pkt->fragoff) {
 		regs->verdict.code = NFT_BREAK;
 		return;
 	}
-- 
2.53.0

[PATCH 2/2 nf v2] netfilter: xtables: fix L4 header parsing for non-first fragments

[Fernando Fernandez Mancera]

Multiple targets and matches relies on L4 header to operate. For
fragmented packets, every fragment carries the transport protocol
identifier, but only the first fragment contains the L4 header.

As the 'raw' table can be configured to run at priority -450 (before
defragmentation at -400), the target/match can be reached before
reassembly. In this case, non-first fragments have their payload
incorrectly parsed as a TCP/UDP header. This would be of course a
misconfiguration scenario. In most of the cases this just lead to a
unreliable behavior for fragmented traffic.

Add a fragment check to ensure target/match only evaluates unfragmented
packets or the first fragment in the stream.

Fixes: 902d6a4c2a4f ("netfilter: nf_defrag: Skip defrag if NOTRACK is set")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
v2: handled ecn, socket and tcpmss matches
---
 net/netfilter/xt_TPROXY.c | 11 +++++++++--
 net/netfilter/xt_ecn.c    |  3 +++
 net/netfilter/xt_osf.c    |  3 +++
 net/netfilter/xt_socket.c | 10 ++++++++--
 net/netfilter/xt_tcpmss.c |  3 +++
 5 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index e4bea1d346cf..5f60e7298a1e 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -86,6 +86,9 @@ tproxy_tg4_v0(struct sk_buff *skb, const struct xt_action_param *par)
 {
 	const struct xt_tproxy_target_info *tgi = par->targinfo;
 
+	if (par->fragoff)
+		return NF_DROP;
+
 	return tproxy_tg4(xt_net(par), skb, tgi->laddr, tgi->lport,
 			  tgi->mark_mask, tgi->mark_value);
 }
@@ -95,6 +98,9 @@ tproxy_tg4_v1(struct sk_buff *skb, const struct xt_action_param *par)
 {
 	const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
 
+	if (par->fragoff)
+		return NF_DROP;
+
 	return tproxy_tg4(xt_net(par), skb, tgi->laddr.ip, tgi->lport,
 			  tgi->mark_mask, tgi->mark_value);
 }
@@ -106,6 +112,7 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
 {
 	const struct ipv6hdr *iph = ipv6_hdr(skb);
 	const struct xt_tproxy_target_info_v1 *tgi = par->targinfo;
+	unsigned short fragoff = 0;
 	struct udphdr _hdr, *hp;
 	struct sock *sk;
 	const struct in6_addr *laddr;
@@ -113,8 +120,8 @@ tproxy_tg6_v1(struct sk_buff *skb, const struct xt_action_param *par)
 	int thoff = 0;
 	int tproto;
 
-	tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
-	if (tproto < 0)
+	tproto = ipv6_find_hdr(skb, &thoff, -1, &fragoff, NULL);
+	if (tproto < 0 || fragoff)
 		return NF_DROP;
 
 	hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c
index b96e8203ac54..cd97c2fac6e7 100644
--- a/net/netfilter/xt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -30,6 +30,9 @@ static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par)
 	struct tcphdr _tcph;
 	const struct tcphdr *th;
 
+	if (par->fragoff)
+		return false;
+
 	/* In practice, TCP match does this, so can't fail.  But let's
 	 * be good citizens.
 	 */
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index dc9485854002..e8807caede68 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -27,6 +27,9 @@
 static bool
 xt_osf_match_packet(const struct sk_buff *skb, struct xt_action_param *p)
 {
+	if (p->fragoff)
+		return false;
+
 	return nf_osf_match(skb, xt_family(p), xt_hooknum(p), xt_in(p),
 			    xt_out(p), p->matchinfo, xt_net(p), nf_osf_fingers);
 }
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 76e01f292aaf..d366e294f1aa 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -55,8 +55,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 	if (sk && !net_eq(xt_net(par), sock_net(sk)))
 		sk = NULL;
 
-	if (!sk)
+	if (!sk) {
+		if (par->fragoff)
+			return false;
 		sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
+	}
 
 	if (sk) {
 		bool wildcard;
@@ -116,8 +119,11 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
 	if (sk && !net_eq(xt_net(par), sock_net(sk)))
 		sk = NULL;
 
-	if (!sk)
+	if (!sk) {
+		if (par->fragoff)
+			return false;
 		sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
+	}
 
 	if (sk) {
 		bool wildcard;
diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
index 0d32d4841cb3..69844cc8dbb8 100644
--- a/net/netfilter/xt_tcpmss.c
+++ b/net/netfilter/xt_tcpmss.c
@@ -32,6 +32,9 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	u8 _opt[15 * 4 - sizeof(_tcph)];
 	unsigned int i, optlen;
 
+	if (par->fragoff)
+		return false;
+
 	/* If we don't have the whole header, drop packet. */
 	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
 	if (th == NULL)
-- 
2.53.0

Re: [PATCH 2/2 nf v2] netfilter: xtables: fix L4 header parsing for non-first fragments

[Pablo Neira Ayuso]

Hi Fernando,

On Mon, Apr 20, 2026 at 12:47:45PM +0200, Fernando Fernandez Mancera wrote:
> diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
> index 76e01f292aaf..d366e294f1aa 100644
> --- a/net/netfilter/xt_socket.c
> +++ b/net/netfilter/xt_socket.c
> @@ -55,8 +55,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
>  	if (sk && !net_eq(xt_net(par), sock_net(sk)))
>  		sk = NULL;
>  
> -	if (!sk)
> +	if (!sk) {
> +		if (par->fragoff)
> +			return false;
>  		sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
> +	}
>  
>  	if (sk) {
>  		bool wildcard;
> @@ -116,8 +119,11 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
>  	if (sk && !net_eq(xt_net(par), sock_net(sk)))
>  		sk = NULL;
>  
> -	if (!sk)
> +	if (!sk) {
> +		if (par->fragoff)
> +			return false;

Your patch will work as intented in iptables over nf_tables, because
it always sets on fragoff regardless user policy.

But, if ipv6_find_hdr() finds no layer 4 protocol, then fragoff
remains zero, and pkt->flags does not set on NFT_PKTINFO_L4PROTO.
There, in nftables, par->fragoff but itself is not reliable because
maybe the layer 4 was not found.

Then, there is ip6_tables legacy which does not behave like ip_tables
for fragments.

ip6t_do_table() only sets fragoff if IP6T_F_PROTO (-p in userspace) is
used, unlike nftables which always sets on fragoff.

So par->fragoff is unreliable in ip6_tables legacy, and
ipv6_find_hdr() is called over and over again ip6_packet_match() loop
for each rule.

One way would be to call ipv6_find_hdr() inconditionally from
ip6_tables legacy, but that belongs to a different patch and that
would be touch core ip6_tables legacy.

Rewinding a bit, coming to back to the original issue: osf only
supports ipv4 :-)

>  		sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
> +	}
>  
>  	if (sk) {
>  		bool wildcard;
> diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
> index 0d32d4841cb3..69844cc8dbb8 100644
> --- a/net/netfilter/xt_tcpmss.c
> +++ b/net/netfilter/xt_tcpmss.c
> @@ -32,6 +32,9 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
>  	u8 _opt[15 * 4 - sizeof(_tcph)];
>  	unsigned int i, optlen;
>  
> +	if (par->fragoff)
> +		return false;
> +
>  	/* If we don't have the whole header, drop packet. */
>  	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
>  	if (th == NULL)
> -- 
> 2.53.0
> 

Re: [PATCH 2/2 nf v2] netfilter: xtables: fix L4 header parsing for non-first fragments

[Pablo Neira Ayuso]

On Mon, Apr 20, 2026 at 10:45:41PM +0200, Pablo Neira Ayuso wrote:
> Hi Fernando,
> 
> On Mon, Apr 20, 2026 at 12:47:45PM +0200, Fernando Fernandez Mancera wrote:
> > diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
> > index 76e01f292aaf..d366e294f1aa 100644
> > --- a/net/netfilter/xt_socket.c
> > +++ b/net/netfilter/xt_socket.c
> > @@ -55,8 +55,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
> >  	if (sk && !net_eq(xt_net(par), sock_net(sk)))
> >  		sk = NULL;
> >  
> > -	if (!sk)
> > +	if (!sk) {
> > +		if (par->fragoff)
> > +			return false;
> >  		sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
> > +	}
> >  
> >  	if (sk) {
> >  		bool wildcard;
> > @@ -116,8 +119,11 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
> >  	if (sk && !net_eq(xt_net(par), sock_net(sk)))
> >  		sk = NULL;
> >  
> > -	if (!sk)
> > +	if (!sk) {
> > +		if (par->fragoff)
> > +			return false;
> 
> Your patch will work as intented in iptables over nf_tables, because
> it always sets on fragoff regardless user policy.
> 
> But, if ipv6_find_hdr() finds no layer 4 protocol, then fragoff
> remains zero, and pkt->flags does not set on NFT_PKTINFO_L4PROTO.
> There, in nftables, par->fragoff but itself is not reliable because
> maybe the layer 4 was not found.

This is where pkt->tprot comes into play. I think this series is fine
with nf_tables, it is just ip6_tables legacy that lags behind.

> Then, there is ip6_tables legacy which does not behave like ip_tables
> for fragments.
> 
> ip6t_do_table() only sets fragoff if IP6T_F_PROTO (-p in userspace) is
> used, unlike nftables which always sets on fragoff.
> 
> So par->fragoff is unreliable in ip6_tables legacy, and
> ipv6_find_hdr() is called over and over again ip6_packet_match() loop
> for each rule.
> 
> One way would be to call ipv6_find_hdr() inconditionally from
> ip6_tables legacy, but that belongs to a different patch and that
> would be touch core ip6_tables legacy.
> 
> Rewinding a bit, coming to back to the original issue: osf only
> supports ipv4 :-)
> 
> >  		sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
> > +	}
> >  
> >  	if (sk) {
> >  		bool wildcard;
> > diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
> > index 0d32d4841cb3..69844cc8dbb8 100644
> > --- a/net/netfilter/xt_tcpmss.c
> > +++ b/net/netfilter/xt_tcpmss.c
> > @@ -32,6 +32,9 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >  	u8 _opt[15 * 4 - sizeof(_tcph)];
> >  	unsigned int i, optlen;
> >  
> > +	if (par->fragoff)
> > +		return false;
> > +
> >  	/* If we don't have the whole header, drop packet. */
> >  	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
> >  	if (th == NULL)
> > -- 
> > 2.53.0
> > 

Re: [PATCH 2/2 nf v2] netfilter: xtables: fix L4 header parsing for non-first fragments

[Fernando Fernandez Mancera]

Hi Pablo,

On 4/20/26 10:58 PM, Pablo Neira Ayuso wrote:
> On Mon, Apr 20, 2026 at 10:45:41PM +0200, Pablo Neira Ayuso wrote:
>> Hi Fernando,
>>
>> On Mon, Apr 20, 2026 at 12:47:45PM +0200, Fernando Fernandez Mancera wrote:
>>> diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
>>> index 76e01f292aaf..d366e294f1aa 100644
>>> --- a/net/netfilter/xt_socket.c
>>> +++ b/net/netfilter/xt_socket.c
>>> @@ -55,8 +55,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
>>>   	if (sk && !net_eq(xt_net(par), sock_net(sk)))
>>>   		sk = NULL;
>>>   
>>> -	if (!sk)
>>> +	if (!sk) {
>>> +		if (par->fragoff)
>>> +			return false;
>>>   		sk = nf_sk_lookup_slow_v4(xt_net(par), skb, xt_in(par));
>>> +	}
>>>   
>>>   	if (sk) {
>>>   		bool wildcard;
>>> @@ -116,8 +119,11 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
>>>   	if (sk && !net_eq(xt_net(par), sock_net(sk)))
>>>   		sk = NULL;
>>>   
>>> -	if (!sk)
>>> +	if (!sk) {
>>> +		if (par->fragoff)
>>> +			return false;
>>
>> Your patch will work as intented in iptables over nf_tables, because
>> it always sets on fragoff regardless user policy.
>>
>> But, if ipv6_find_hdr() finds no layer 4 protocol, then fragoff
>> remains zero, and pkt->flags does not set on NFT_PKTINFO_L4PROTO.
>> There, in nftables, par->fragoff but itself is not reliable because
>> maybe the layer 4 was not found.
> 
> This is where pkt->tprot comes into play. I think this series is fine
> with nf_tables, it is just ip6_tables legacy that lags behind.
> 

Hm, I didn't know this. Thanks for explaining. Then xt_socket is safe 
for IPv6 as the code does:

         tproto = ipv6_find_hdr(skb, &thoff, -1, NULL, NULL);
         if (tproto < 0) {
                 pr_debug("unable to find transport header in IPv6 
packet, dropping\n");
                 return NULL;
         }

at nf_socket_get_sock_v6()

Okay, let me re-send adjusting the IPv6 part..

>> Then, there is ip6_tables legacy which does not behave like ip_tables
>> for fragments.
>>
>> ip6t_do_table() only sets fragoff if IP6T_F_PROTO (-p in userspace) is
>> used, unlike nftables which always sets on fragoff.
>>
>> So par->fragoff is unreliable in ip6_tables legacy, and
>> ipv6_find_hdr() is called over and over again ip6_packet_match() loop
>> for each rule.
>>
>> One way would be to call ipv6_find_hdr() inconditionally from
>> ip6_tables legacy, but that belongs to a different patch and that
>> would be touch core ip6_tables legacy.
>>
>> Rewinding a bit, coming to back to the original issue: osf only
>> supports ipv4 :-)
>>

Right, but we need to fix this everywhere not only in osf.

Thanks,
Fernando.

>>>   		sk = nf_sk_lookup_slow_v6(xt_net(par), skb, xt_in(par));
>>> +	}
>>>   
>>>   	if (sk) {
>>>   		bool wildcard;
>>> diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c
>>> index 0d32d4841cb3..69844cc8dbb8 100644
>>> --- a/net/netfilter/xt_tcpmss.c
>>> +++ b/net/netfilter/xt_tcpmss.c
>>> @@ -32,6 +32,9 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par)
>>>   	u8 _opt[15 * 4 - sizeof(_tcph)];
>>>   	unsigned int i, optlen;
>>>   
>>> +	if (par->fragoff)
>>> +		return false;
>>> +
>>>   	/* If we don't have the whole header, drop packet. */
>>>   	th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
>>>   	if (th == NULL)
>>> -- 
>>> 2.53.0
>>>
>