Re: [PATCH] netfilter: xt_dccp: handle reserved options as single-byte

[Florian Westphal <fw@strlen.de>]

성병찬 <tjdqudcks0424@naver.com> wrote:
> 
> -----Original Message-----
> From: "Fernando Fernandez Mancera"<fmancera@suse.de>
> To: <tjdqudcks0424@naver.com>; "Pablo Neira Ayuso"<pablo@netfilter.org>; "Florian Westphal"<fw@strlen.de>;
> Cc: <netfilter-devel@vger.kernel.org>;
> Sent: 2026-10-09 (금) 17:34:55 (GMT+09:00)
> Subject: Re: [PATCH] netfilter: xt_dccp: handle reserved options as single-byte
> 
> On 10/8/26 8:38 PM, tjdqudcks0424@naver.com wrote:
> > From: Sung Byeongchan <tjdqudcks0424@naver.com>
> >
> > The DCCP UAPI defines option numbers 3 through 31 as reserved.  Like
> > Padding and Mandatory, these options occupy one byte.  dccp_find_option()
> > only treats values below 2 as single-byte and interprets the byte after a
> > reserved option as a TLV length.
> >
> > This can skip a later option and invert an XT_DCCP_OPTION rule result.  A
> > local production-hook fixture installed the same DROP rule for IPv4 and
> > IPv6.  In three fresh boots per kernel, a target-only packet was dropped
> > 20/20 times, while adding reserved option 3 before the same target let
> > 20/20 packets reach the protected receiver.  The fixed kernel dropped all
> > trigger packets in three fresh boots and preserved the normal controls.
> >
> > Treat every option up to DCCPO_MAX_RESERVED as single-byte, matching the
> > protocol definition.  Triggering requires
> > CONFIG_NETFILTER_XTABLES_LEGACY, CONFIG_NETFILTER_XT_MATCH_DCCP, an
> > option-based rule, and remote protocol-33 reachability.  The touched source
> > is unchanged at 0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where the patch
> > applies and builds cleanly.
> >
> > The demonstrated impact is a conditional remote filter-verdict bypass.
> > No memory-safety violation, information disclosure, RCE, or LPE was
> > demonstrated.  The source reproducer and complete logs are available on
> > request and are not included in this public report.
> >
> > OpenAI Codex assisted source inspection, test design, patch drafting, and
> > evidence organization.
> >
> > Fixes: 1d3de414eb20 ("[NETFILTER]: New iptables DCCP protocol header match")
> > Assisted-by: LLM
> > Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
> 
> The commit message is a bit too verbose and I doubt this has been found
> in a real environment. This might be a bit too extreme from my side but
> can we ditch DCCP support?

See: 606bd17ef0de ("netfilter: add deprecation warning for dccp support")

> Pablo, Florian, what direction would you prefer?

Well, you already made a fix and it makes more sense from -stable PoV.
So I'd say: Fix and then zap this thing early in 2027.