[PATCH v3] net/sched: act_nat: only rewrite IPv4 packets

[PATCH v3] net/sched: act_nat: only rewrite IPv4 packets

[Samuel Moelius]

act_nat can process packets whose protocol is not IPv4 and then
interpret the payload as an IPv4 header.  Non-IPv4 packets may be
modified based on unrelated bytes at the network header offset.

The action is documented as IPv4 NAT and should leave other protocols
alone.

Check skb->protocol before parsing and rewriting the IPv4 header.  This
keeps accepting hardware-accelerated VLAN IPv4 packets whose network
header already points at the IPv4 header, while still rejecting inline
VLAN packets because act_nat does not adjust the network header offset
before using ip_hdr(skb).

Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
---
Changes in v3:
  - Check skb->protocol
Changes in v2:
  - Check skb_protocol(skb, false)

 net/sched/act_nat.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index abb332dee836..1bf4a5853617 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -142,6 +142,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
 	egress = parms->flags & TCA_NAT_FLAG_EGRESS;
 
 	noff = skb_network_offset(skb);
+	if (skb->protocol != htons(ETH_P_IP))
+		goto out;
+
 	if (!pskb_may_pull(skb, sizeof(*iph) + noff))
 		goto drop;
 
-- 
2.43.0

Re: [PATCH v3] net/sched: act_nat: only rewrite IPv4 packets

[Paolo Abeni]

On 6/28/26 3:20 PM, Samuel Moelius wrote:
> act_nat can process packets whose protocol is not IPv4 and then
> interpret the payload as an IPv4 header.  Non-IPv4 packets may be
> modified based on unrelated bytes at the network header offset.
> 
> The action is documented as IPv4 NAT and should leave other protocols
> alone.
> 
> Check skb->protocol before parsing and rewriting the IPv4 header.  This
> keeps accepting hardware-accelerated VLAN IPv4 packets whose network
> header already points at the IPv4 header, while still rejecting inline
> VLAN packets because act_nat does not adjust the network header offset
> before using ip_hdr(skb).
> 
> Fixes: b4219952356b ("[PKT_SCHED]: Add stateless NAT")
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
> ---
> Changes in v3:
>   - Check skb->protocol
> Changes in v2:
>   - Check skb_protocol(skb, false)
> 
>  net/sched/act_nat.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
> index abb332dee836..1bf4a5853617 100644
> --- a/net/sched/act_nat.c
> +++ b/net/sched/act_nat.c
> @@ -142,6 +142,9 @@ TC_INDIRECT_SCOPE int tcf_nat_act(struct sk_buff *skb,
>  	egress = parms->flags & TCA_NAT_FLAG_EGRESS;
>  
>  	noff = skb_network_offset(skb);
> +	if (skb->protocol != htons(ETH_P_IP))

AFAICS, in the xmit path, for actions applied at the H/W NIC level,
without vlan H/W offload, the above test check will fail, even if the
current code would work just fine (skb->network_header points to the
actual IPv4 header).

My take is implementing a robust and safe check here would be overkill.
Users should attach the action to the correct filter.

/P



> +		goto out;
> +
>  	if (!pskb_may_pull(skb, sizeof(*iph) + noff))
>  		goto drop;
>