Re: [PATCH net 0/2] ipv4: harden against ihl < 5 IP_HDRINCL packets

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, May 12, 2026 at 04:51:13PM -0400, Michael Bommarito wrote:
[...]
> Open question for netfilter / netdev
> ------------------------------------
> 
> After patch 1/2 lands, a caller with CAP_NET_ADMIN can still
> deliver an ihl < 5 packet into the post-LOCAL_OUT in-stack path by
> attaching an nftables payload-set rule on NF_INET_LOCAL_OUT (or an
> NFQUEUE reinject on the same hook) that rewrites byte 0 of the
> IPv4 header after the raw_send_hdrinc / __ip_local_out validation
> has run.

There are possibly more ways to mangle ihl in the kernel in 2026, not
only NFQUEUE and nft_payload.

> Construction:
> 
>     nft add table ip mangle
>     nft add chain ip mangle output { type filter hook output \
>                                      priority -150 \; }
>     nft add rule ip mangle output ip daddr <victim> \
>                                   @nh,0,8 set 0x40
> 
> I reproduced this separately with nftables payload-set delivering an
> ihl = 0 packet to xfrm4_output() and onward.  Patch 2/2 covers the
> AH consumer; other consumers that read iph->ihl after the LOCAL_OUT
> hook may be similarly exposed and I have not enumerated them.
> 
> Direction question rather than a fix proposal: does basic iphdr
> re-sanitization after a header-mangling hook belong in the netfilter
> machinery, in each in-stack consumer, or both?

Your patches LGTM, are you suggesting more patches?