Re: [PATCH v3] net/sched: act_nat: only rewrite IPv4 packets

[Paolo Abeni <pabeni@redhat.com>]

On 6/28/26 3:20 PM, Samuel Moelius wrote:
> act_nat can process packets whose protocol is not IPv4 and then
> interpret the payload as an IPv4 header.  Non-IPv4 packets may be
> modified based on unrelated bytes at the network header offset.
> 
> The action is documented as IPv4 NAT and should leave other protocols
> alone.
> 
> Check skb->protocol before parsing and rewriting the IPv4 header.  This
> keeps accepting hardware-accelerated VLAN IPv4 packets whose network
> header already points at the IPv4 header, while still rejecting inline
> VLAN packets because act_nat does not adjust the network header offset
> before using ip_hdr(skb).
> 
> Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT")
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
> ---
> Changes in v3:
>   - Check skb->protocol
> Changes in v2:
>   - Check skb_protocol(skb, false)
> 
>  net/sched/act_nat.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
> index abb332dee836..1bf4a5853617 100644
> --- a/net/sched/act_nat.c
> +++ b/net/sched/act_nat.c
> @@ -142,6 +142,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
>  	egress = parms->flags & TCA_NAT_FLAG_EGRESS;
>  
>  	noff = skb_network_offset(skb);
> +	if (skb->protocol != htons(ETH_P_IP))

AFAICS, in the xmit path, for actions applied at the H/W NIC level,
without vlan H/W offload, the above test check will fail, even if the
current code would work just fine (skb->network_header points to the
actual IPv4 header).

My take is implementing a robust and safe check here would be overkill.
Users should attach the action to the correct filter.

/P



> +		goto out;
> +
>  	if (!pskb_may_pull(skb, sizeof(*iph) + noff))
>  		goto drop;
>