From: Florian Westphal <fw@strlen.de>
To: Jakub Kicinski <kuba@kernel.org>
Cc: pablo@netfilter.org, netfilter-devel@vger.kernel.org,
davem@davemloft.net, netdev@vger.kernel.org, pabeni@redhat.com,
edumazet@google.com, horms@kernel.org, ja@ssi.bg
Subject: Re: [PATCH net 07/12] netfilter: nft_payload: restrict checksum offsets to known values
Date: Fri, 4 Sep 2026 07:56:01 +0200 [thread overview]
Message-ID: <appdPTMTwCeFBce3@strlen.de> (raw)
In-Reply-To: <20260904020148.3549914-1-kuba@kernel.org>
Jakub Kicinski <kuba@kernel.org> wrote:
> [Severity: High]
> Should nft_payload_csum_th_write_ok() also handle IPPROTO_ICMP? There is
> no arm for it, and neither IPPROTO_ICMP nor struct icmphdr appear anywhere
> in nft_payload.c (linux/icmp.h is not included), so pkt->tprot ==
> IPPROTO_ICMP falls out of the switch and returns false.
Sigh.
> Two things that may be worth considering: adding
>
> case IPPROTO_ICMP:
> return priv->csum_offset == offsetof(struct icmphdr, checksum);
>
> to nft_payload_csum_th_write_ok(), and making the run time refusal set
> NFT_BREAK rather than silently skipping the checksum update, so load time
> and run time agree.
Sigh.
next prev parent reply other threads:[~2026-09-04 5:56 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 0:41 [PATCH net 00/12] Netfilter/IPVS fixes for net Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 01/12] ipvs: reject invalid states in connection template sync records Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 02/12] ipvs: fix reversed sequence option serialization Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 03/12] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 04/12] netfilter: cttimeout: prevent UAF during module unload Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 05/12] netfilter: nf_log: unregister loggers before per-net teardown Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 06/12] ipvs: bound LBLCR and LBLC cache growth Pablo Neira Ayuso
2026-09-04 2:01 ` Jakub Kicinski
2026-09-04 4:20 ` Julian Anastasov
2026-09-09 12:24 ` Julian Anastasov
2026-09-09 23:47 ` Pablo Neira Ayuso
2026-09-10 10:26 ` Julian Anastasov
2026-09-03 0:41 ` [PATCH net 07/12] netfilter: nft_payload: restrict checksum offsets to known values Pablo Neira Ayuso
2026-09-04 2:01 ` Jakub Kicinski
2026-09-04 5:56 ` Florian Westphal [this message]
2026-09-03 0:41 ` [PATCH net 08/12] netfilter: nfnetlink_log: cope with concurrent instance destruction Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 09/12] netfilter: nfnetlink_queue: hold nfnl mutex in event notifier Pablo Neira Ayuso
2026-09-04 2:01 ` Jakub Kicinski
2026-09-04 5:56 ` Florian Westphal
2026-09-03 0:41 ` [PATCH net 10/12] netfilter: arp_tables: remove the 32bit compat interface Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 11/12] netfilter: ip6_tables: set F_PROTO when proto value is nonzero Pablo Neira Ayuso
2026-09-03 0:41 ` [PATCH net 12/12] netfilter: report NLM_F_DUMP_FILTERED when all is filtered out Pablo Neira Ayuso
2026-09-04 2:04 ` [PATCH net 00/12] Netfilter/IPVS fixes for net Jakub Kicinski
2026-09-04 5:57 ` Florian Westphal
2026-09-04 10:55 ` Pablo Neira Ayuso
2026-09-04 10:59 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=appdPTMTwCeFBce3@strlen.de \
--to=fw@strlen.de \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=ja@ssi.bg \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.