* Re: [PATCH nf v3] netfilter: ip6tables: set hotdrop for malformed extension header matches
[not found] <20260724110111.18783-1-running910@gmail.com>
@ 2026-07-31 11:11 ` Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2026-07-31 11:11 UTC (permalink / raw)
To: Zhixing Chen
Cc: Florian Westphal, Phil Sutter, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, netfilter-devel,
coreteam, netdev
On Fri, Jul 24, 2026 at 07:01:11PM +0800, Zhixing Chen wrote:
> The hbh, srh and ipv6header matches have paths that return false for
> malformed IPv6 extension header packets without setting hotdrop.
>
> For hbh, strict option parsing stops when the option type or length field
> cannot be read, or when advancing to the next requested option would
> exceed the available header data. Mark these packets for hotdrop instead
> of treating them as a rule mismatch.
>
> For srh, keep a missing SRH as a normal mismatch, but set hotdrop when
> header lookup fails for other reasons, when the SRH fixed header is not
> present, when the advertised SRH length exceeds the available skb data,
> when segments_left exceeds first_segment, when the SID list implied by
> first_segment exceeds the advertised SRH length, or when SID selector
> reads fail.
>
> For ipv6header, set hotdrop when the advertised extension header length
> exceeds the available skb data.
>
> Returning false treats the packet as a rule mismatch. Set hotdrop for
> these malformed packets so they cannot bypass rules intended to drop
> packets with these IPv6 extension headers.
This patch should target nf-next, it does not fix any real crash.
There are also issues in this patch to be addressed, see:
https://sashiko.dev/#/patchset/20260724110111.18783-1-running910%40gmail.com
^ permalink raw reply [flat|nested] only message in thread