[PATCH nf] netfilter: ip6t_ah: validate AH header length

[PATCH nf] netfilter: ip6t_ah: validate AH header length

[Zhixing Chen]

ip6t_ah checks that the fixed AH header is present, then uses hdrlen to
derive the advertised AH header length for matching.

Return false if the skb does not contain the advertised AH header length.
This avoids matching AH headers whose advertised length is not present in
the skb.

Signed-off-by: Zhixing Chen <running910@gmail.com>
---

I noticed ip6t_hbh and ip6t_rt already do this advertised-length check
for their IPv6 extension headers, so this keeps ip6t_ah in line with
those matches.

---
 net/ipv6/netfilter/ip6t_ah.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 70da2f2ce064..a40240125a1b 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -56,6 +56,10 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	}
 
 	hdrlen = ipv6_authlen(ah);
+	if (skb->len - ptr < hdrlen) {
+		/* Packet smaller than its length field */
+		return false;
+	}
 
 	pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
 	pr_debug("RES %04X ", ah->reserved);
-- 
2.34.1

Re: [PATCH nf] netfilter: ip6t_ah: validate AH header length

[Florian Westphal]

Zhixing Chen <running910@gmail.com> wrote:
> ip6t_ah checks that the fixed AH header is present, then uses hdrlen to
> derive the advertised AH header length for matching.
> 
> Return false if the skb does not contain the advertised AH header length.
> This avoids matching AH headers whose advertised length is not present in
> the skb.
> 
> Signed-off-by: Zhixing Chen <running910@gmail.com>
> ---
> 
> I noticed ip6t_hbh and ip6t_rt already do this advertised-length check
> for their IPv6 extension headers, so this keeps ip6t_ah in line with
> those matches.

Could you make a v2 that addresses

https://sashiko.dev/#/patchset/20260618125848.93550-1-running910%40gmail.com
?

We should not return false in matches for malformed packets without
also setting ->hotdrop = true.

Re: [PATCH nf] netfilter: ip6t_ah: validate AH header length

[Zhixing Chen]

> We should not return false in matches for malformed packets without
> also setting ->hotdrop = true.

Thanks a lot for taking a careful look, I really appreciate it.

I agree. Returning false makes the packet a rule mismatch, while this
condition means the packet is malformed. I will send a v2 that sets
->hotdrop before returning false in ah, and applies the same
malformed-header handling to hbh and rt as well.