From 2edda78aa4eb04cd8f112a81897510ee0cdd7099 Mon Sep 17 00:00:00 2001 From: Sung Byeongchan Date: Fri, 9 Oct 2026 03:38:14 +0900 Subject: [PATCH] netfilter: xt_dccp: handle reserved options as single-byte The DCCP UAPI defines option numbers 3 through 31 as reserved. Like Padding and Mandatory, these options occupy one byte. dccp_find_option() only treats values below 2 as single-byte and interprets the byte after a reserved option as a TLV length. This can skip a later option and invert an XT_DCCP_OPTION rule result. A local production-hook fixture installed the same DROP rule for IPv4 and IPv6. In three fresh boots per kernel, a target-only packet was dropped 20/20 times, while adding reserved option 3 before the same target let 20/20 packets reach the protected receiver. The fixed kernel dropped all trigger packets in three fresh boots and preserved the normal controls. Treat every option up to DCCPO_MAX_RESERVED as single-byte, matching the protocol definition. Triggering requires CONFIG_NETFILTER_XTABLES_LEGACY, CONFIG_NETFILTER_XT_MATCH_DCCP, an option-based rule, and remote protocol-33 reachability. The touched source is unchanged at 0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where the patch applies and builds cleanly. Fixes: 1d3de414eb20 ("[NETFILTER]: New iptables DCCP protocol header match") Assisted-by: LLM Signed-off-by: Sung Byeongchan Signed-off-by: Pablo Neira Ayuso --- net/netfilter/xt_dccp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/xt_dccp.c b/net/netfilter/xt_dccp.c index 3db81e041af9..23a4e3e8df7d 100644 --- a/net/netfilter/xt_dccp.c +++ b/net/netfilter/xt_dccp.c @@ -62,7 +62,7 @@ dccp_find_option(u_int8_t option, return true; } - if (op[i] < 2 || i == optlen - 1) + if (op[i] <= DCCPO_MAX_RESERVED || i == optlen - 1) i++; else i += op[i + 1] ? : 1;