[PATCH nf] netfilter: use skb len to match in length_mt6

[PATCH nf] netfilter: use skb len to match in length_mt6

[Xin Long]

For IPv6 Jumbo packets, the ipv6_hdr(skb)->payload_len is always 0,
and its real payload_len ( > 65535) is saved in hbh exthdr. With 0
length for the jumbo packets, it may mismatch.

To fix this, we can just use skb->len instead of parsing exthdrs, as
the hbh exthdr parsing has been done before coming to length_mt6 in
ip6_rcv_core() and br_validate_ipv6() and also the packet has been
trimmed according to the correct IPv6 (ext)hdr length there, and skb
len is trustable in length_mt6().

Note that this patch is especially needed after the IPv6 BIG TCP was
supported in kernel, which is using IPv6 Jumbo packets. Besides, to
match the packets greater than 65535 more properly, a v1 revision of
xt_length may be needed to extend "min, max" to u32 in the future,
and for now the IPv6 Jumbo packets can be matched by:

  # ip6tables -m length ! --length 0:65535

Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
 net/netfilter/xt_length.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/netfilter/xt_length.c b/net/netfilter/xt_length.c
index 1873da3a945a..9fbfad13176f 100644
--- a/net/netfilter/xt_length.c
+++ b/net/netfilter/xt_length.c
@@ -30,8 +30,7 @@ static bool
 length_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 {
 	const struct xt_length_info *info = par->matchinfo;
-	const u_int16_t pktlen = ntohs(ipv6_hdr(skb)->payload_len) +
-				 sizeof(struct ipv6hdr);
+	u32 pktlen = skb->len;
 
 	return (pktlen >= info->min && pktlen <= info->max) ^ info->invert;
 }
-- 
2.39.1

Re: [PATCH nf] netfilter: use skb len to match in length_mt6

[Pablo Neira Ayuso]

On Fri, Feb 17, 2023 at 06:22:57PM -0500, Xin Long wrote:
> For IPv6 Jumbo packets, the ipv6_hdr(skb)->payload_len is always 0,
> and its real payload_len ( > 65535) is saved in hbh exthdr. With 0
> length for the jumbo packets, it may mismatch.
> 
> To fix this, we can just use skb->len instead of parsing exthdrs, as
> the hbh exthdr parsing has been done before coming to length_mt6 in
> ip6_rcv_core() and br_validate_ipv6() and also the packet has been
> trimmed according to the correct IPv6 (ext)hdr length there, and skb
> len is trustable in length_mt6().
> 
> Note that this patch is especially needed after the IPv6 BIG TCP was
> supported in kernel, which is using IPv6 Jumbo packets. Besides, to
> match the packets greater than 65535 more properly, a v1 revision of
> xt_length may be needed to extend "min, max" to u32 in the future,
> and for now the IPv6 Jumbo packets can be matched by:
> 
>   # ip6tables -m length ! --length 0:65535

Applied, thanks