npf_ip_src_addr_match() is using packet address family before it is set

[zagor]

Describe the bug

I'm trying network packet filtering and NPF_IP_SRC_ADDR_ALLOWLIST but struggle with it. After debugging a bit, I don't understand how this is supposed to work.

Ethernet packets enter net_recv_data(), which calls net_pkt_filter_recv_ok() to see if the packet should be accepted or dropped. If accepted, the packet is passed to net_queue_rx(), where it eventually ends up in ethernet_ip_recv(), which calls net_pkt_set_family() on it. Up until then, it is AF_UNSPEC.

One of the filters that can be called by net_pkt_filter_recv_ok() is npf_ip_src_addr_match(). It looks at the address family to see which address filter to use. But the address family is not set until later, so the address filter is never applied.

Here's the call graph:

net_recv_data()
 net_pkt_filter_recv_ok()
  lock_evaluate()
   evaluate()
    apply_tests()
     npf_ip_src_addr_match()
     {
        uint8_t pkt_family = net_pkt_family(pkt);
 net_queue_rx()
  net_process_rx_packet()
   net_rx()
    processing_data()
     process_data()
      net_if_recv_data()
       ethernet_recv()
        ethernet_ip_recv()
        {
          net_pkt_set_family(pkt, AF_INET6);

We have tests for the filters in tests/net/npf but they test the filter with a fully populated net_pkt struct. It appears we don't test passing the packet through the network stack.

Regression

• This is a regression.

Steps to reproduce

struct in6_addr ipv6_address = {.s6_addr = { 0xaa, 0xbb, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x1 }};
NPF_IP_SRC_ADDR_ALLOWLIST(allowlist_ipv6_src_addr, (void *)&ipv6_address, 1, AF_INET6);
NPF_RULE(ipv6_allowlist, NET_OK, allowlist_ipv6_src_addr);

npf_append_recv_rule(&ipv6_allowlist);
npf_append_recv_rule(&npf_default_drop);

Relevant log output

Impact

Functional Limitation – Some features not working as expected, but system usable.

Environment

Zephyr v4.2.1, but I don't see any relevant changes since in 4.3 or master.

Tested on STM32 hardware.

Additional Context

No response

[rlubos]

Note that NPF filtering has different "levels", you're referring to the lowest (L2/Eth) level of filtering, but there is also filtering at the IP layer later:

zephyr/subsys/net/ip/ipv6.c

Line 585 in e02845b

if (!net_pkt_filter_ip_recv_ok(pkt)) {

Each "level" has a separate set of rules, and each rule "group" has a separate set of macros to install/remove filtering rules, for example for IPv6 filtering:

zephyr/include/zephyr/net/net_pkt_filter.h

Lines 177 to 180 in e02845b

	#define npf_insert_ipv6_recv_rule(rule) npf_insert_rule(&npf_ipv6_recv_rules, rule)
	#define npf_append_ipv6_recv_rule(rule) npf_append_rule(&npf_ipv6_recv_rules, rule)
	#define npf_remove_ipv6_recv_rule(rule) npf_remove_rule(&npf_ipv6_recv_rules, rule)
	#define npf_remove_all_ipv6_recv_rules() npf_remove_all_rules(&npf_ipv6_recv_rules)

I don't have too much experience with this component, but it seems you should simply be using npf_append_ipv6_recv_rule() instead of npf_append_recv_rule() to install IPv6 allowlist filter.

[zagor]

Thank you, that makes sense.

But it's very hidden. We don't use these API calls in any tests or sample code, nor are they mentioned in https://docs.zephyrproject.org/latest/connectivity/networking/api/net_pkt_filter.html or even in https://docs.zephyrproject.org/latest/doxygen/html/group__net__pkt__filter.html.

In fact, https://docs.zephyrproject.org/latest/connectivity/networking/api/net_pkt_filter.html explicitly says:

Currently, two such rule lists exist: npf_send_rules for outgoing packets, and npf_recv_rules for incoming packets.

...which certainly game me the impression there were no other rule lists/groups to explore.

So even if this code works as intended (which I'm not qualified to determine) it needs to be documented.

EDIT: And how does combining different rule groups work? In which order do they run? Where does the npf_default_drop rule go? Etc etc.

[jukkar]

As you noticed, packet filter documentation needs some improvements. Patches are welcome if you are able to send any.
Did you check samples/net/pkt_filter what it does, there is also net filter shell command that shows the rules.

[zagor]

I'd love to help, but I'm still grepping through the code and trial-error trying to understand how to use this for my singular use case. I am not in a state where I can teach others.

[jukkar]

I'd love to help, but I'm still grepping through the code and trial-error trying to understand how to use this for my singular use case. I am not in a state where I can teach others.

Ok, no worries, I can try to come up with something for this.

[jukkar]

@zagor please take a look at #100724 if it gives useful information to the end user.