[PATCH nf v8 3/3] netfilter: nf_dup: prevent TTL and hop-limit underflow

[Zihan Xi]

The IPv4 and IPv6 duplication helpers decrement TTL or hop limit for
copies processed at PRE_ROUTING or LOCAL_IN. Stop duplicating when the
value is at or below one, before a subsequent decrement can wrap.

Fixes: e281b19897dc ("netfilter: xtables: inclusion of xt_TEE")
Cc: sta...@vger.kernel.org
Reported-by: Vega <v...@nebusec.ai>
Assisted-by: LLM
Co-developed-by: Luxing Yin <r...@tr0jan.top>
Signed-off-by: Luxing Yin <r...@tr0jan.top>
Signed-off-by: Zihan Xi <zih...@nebusec.ai>
---
 net/ipv4/netfilter/nf_dup_ipv4.c | 3 +++
 net/ipv6/netfilter/nf_dup_ipv6.c | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/net/ipv4/netfilter/nf_dup_ipv4.c b/net/ipv4/netfilter/nf_dup_ipv4.c
index 9a773502f10a..5f9d6c473fb0 100644
--- a/net/ipv4/netfilter/nf_dup_ipv4.c
+++ b/net/ipv4/netfilter/nf_dup_ipv4.c
@@ -56,6 +56,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, 
unsigned int hooknum,
        local_bh_disable();
        if (current->in_nf_duplicate)
                goto out;
+       if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_LOCAL_IN) &&
+           ip_hdr(skb)->ttl <= 1)
+               goto out;
        /*
         * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
         * the original skb, which should continue on its way as if nothing has
diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c
index 6da3102b7c1b..5095f9623001 100644
--- a/net/ipv6/netfilter/nf_dup_ipv6.c
+++ b/net/ipv6/netfilter/nf_dup_ipv6.c
@@ -50,6 +50,9 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, 
unsigned int hooknum,
        local_bh_disable();
        if (current->in_nf_duplicate)
                goto out;
+       if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_LOCAL_IN) &&
+           ipv6_hdr(skb)->hop_limit <= 1)
+               goto out;
        skb = pskb_copy(skb, GFP_ATOMIC);
        if (skb == NULL)
                goto out;
-- 
2.43.0