Re: [PATCH nf v3] netfilter: ip6tables: set hotdrop for malformed extension header matches

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Jul 24, 2026 at 07:01:11PM +0800, Zhixing Chen wrote:
> The hbh, srh and ipv6header matches have paths that return false for
> malformed IPv6 extension header packets without setting hotdrop.
> 
> For hbh, strict option parsing stops when the option type or length field
> cannot be read, or when advancing to the next requested option would
> exceed the available header data. Mark these packets for hotdrop instead
> of treating them as a rule mismatch.
> 
> For srh, keep a missing SRH as a normal mismatch, but set hotdrop when
> header lookup fails for other reasons, when the SRH fixed header is not
> present, when the advertised SRH length exceeds the available skb data,
> when segments_left exceeds first_segment, when the SID list implied by
> first_segment exceeds the advertised SRH length, or when SID selector
> reads fail.
> 
> For ipv6header, set hotdrop when the advertised extension header length
> exceeds the available skb data.
> 
> Returning false treats the packet as a rule mismatch. Set hotdrop for
> these malformed packets so they cannot bypass rules intended to drop
> packets with these IPv6 extension headers.

This patch should target nf-next, it does not fix any real crash.

There are also issues in this patch to be addressed, see:

https://sashiko.dev/#/patchset/20260724110111.18783-1-running910%40gmail.com