From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Zhixing Chen <running910@gmail.com>
Cc: Florian Westphal <fw@strlen.de>, Phil Sutter <phil@nwl.cc>,
"David S . Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org
Subject: Re: [PATCH nf v3] netfilter: ip6tables: set hotdrop for malformed extension header matches
Date: Fri, 31 Jul 2026 13:11:43 +0200 [thread overview]
Message-ID: <amyC7_3bbwJpXIPd@chamomile> (raw)
In-Reply-To: <20260724110111.18783-1-running910@gmail.com>
On Fri, Jul 24, 2026 at 07:01:11PM +0800, Zhixing Chen wrote:
> The hbh, srh and ipv6header matches have paths that return false for
> malformed IPv6 extension header packets without setting hotdrop.
>
> For hbh, strict option parsing stops when the option type or length field
> cannot be read, or when advancing to the next requested option would
> exceed the available header data. Mark these packets for hotdrop instead
> of treating them as a rule mismatch.
>
> For srh, keep a missing SRH as a normal mismatch, but set hotdrop when
> header lookup fails for other reasons, when the SRH fixed header is not
> present, when the advertised SRH length exceeds the available skb data,
> when segments_left exceeds first_segment, when the SID list implied by
> first_segment exceeds the advertised SRH length, or when SID selector
> reads fail.
>
> For ipv6header, set hotdrop when the advertised extension header length
> exceeds the available skb data.
>
> Returning false treats the packet as a rule mismatch. Set hotdrop for
> these malformed packets so they cannot bypass rules intended to drop
> packets with these IPv6 extension headers.
This patch should target nf-next, it does not fix any real crash.
There are also issues in this patch to be addressed, see:
https://sashiko.dev/#/patchset/20260724110111.18783-1-running910%40gmail.com
prev parent reply other threads:[~2026-07-31 11:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 11:01 [PATCH nf v3] netfilter: ip6tables: set hotdrop for malformed extension header matches Zhixing Chen
2026-07-31 11:11 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=amyC7_3bbwJpXIPd@chamomile \
--to=pablo@netfilter.org \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=phil@nwl.cc \
--cc=running910@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.