diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-06-10 20:20:31 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-06-16 20:51:50 +0200 |
| commit | 8f518d43f89ae00b9cf5460e10b91694944ca1a8 (patch) | |
| tree | c5eaf39218f5a65a61920c8d8ba3f45958945f2f /net | |
| parent | netfilter: nft_exthdr: check for IPv6 packet before further processing (diff) | |
| download | linux-8f518d43f89ae00b9cf5460e10b91694944ca1a8.tar.xz linux-8f518d43f89ae00b9cf5460e10b91694944ca1a8.zip | |
netfilter: nft_osf: check for TCP packet before further processing
The osf expression only supports for TCP packets, add a upfront sanity
check to skip packet parsing if this is not a TCP packet.
Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nft_osf.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c index ac61f708b82d..d82677e83400 100644 --- a/net/netfilter/nft_osf.c +++ b/net/netfilter/nft_osf.c @@ -28,6 +28,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs, struct nf_osf_data data; struct tcphdr _tcph; + if (pkt->tprot != IPPROTO_TCP) { + regs->verdict.code = NFT_BREAK; + return; + } + tcp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(struct tcphdr), &_tcph); if (!tcp) { |