Re: [PATCH v2] netfilter: xt_multiport: reject trailing range markers

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Apr 01, 2026 at 01:29:38AM +0200, Pablo Neira Ayuso wrote:
> Hi,
> 
> On Sat, Mar 28, 2026 at 10:51:23PM +0800, Ren Wei wrote:
> > diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c
> > index 44a00f5acde8..38aa5b90d38e 100644
> > --- a/net/netfilter/xt_multiport.c
> > +++ b/net/netfilter/xt_multiport.c
> > @@ -26,10 +26,10 @@ MODULE_ALIAS("ip6t_multiport");
> >  /* Returns 1 if the port is matched by the test, 0 otherwise. */
> >  static inline bool
> >  ports_match_v1(const struct xt_multiport_v1 *minfo,
> > -	       u_int16_t src, u_int16_t dst)
> > +	       u16 src, u16 dst)
> >  {
> >  	unsigned int i;
> > -	u_int16_t s, e;
> > +	u16 s, e;
> >  
> >  	for (i = 0; i < minfo->count; i++) {
> >  		s = minfo->ports[i];
> 
> I see, this is a cleanup to use preferred datatypes.
> 
> > @@ -106,20 +106,36 @@ multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
> >  }
> >  
> >  static inline bool
> > -check(u_int16_t proto,
> > -      u_int8_t ip_invflags,
> > -      u_int8_t match_flags,
> > -      u_int8_t count)
> > +multiport_valid_ranges(const struct xt_multiport_v1 *multiinfo)
> > +{
> > +	unsigned int i;
> > +
> > +	for (i = 0; i < multiinfo->count; i++) {
> > +		if (!multiinfo->pflags[i])
> > +			continue;
> > +
> > +		if (i == multiinfo->count - 1)
> > +			return false;
> > +
> > +		i++;
> > +	}
> 
> Why so convoluted? This should just fix this bug:
> 
> static bool multiport_valid_ranges(const struct xt_multiport_v1 *multiinfo)
> {
>         return multiinfo->pflags[multiinfo->count - 1] == 0;
> }

Another possibility is full-blown range validation, ie.

if pflags[i] is one, then pflags[i+1] must be zero, checking that i+1
do not go over XT_MULTI_PORTS beforehand.