| From 0b517fe5d631f28f26f1e86d22adf213689f04ac Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 10 Jun 2021 20:20:31 +0200 |
| Subject: netfilter: nft_osf: check for TCP packet before further processing |
| |
| From: Pablo Neira Ayuso <pablo@netfilter.org> |
| |
| [ Upstream commit 8f518d43f89ae00b9cf5460e10b91694944ca1a8 ] |
| |
| The osf expression only supports for TCP packets, add a upfront sanity |
| check to skip packet parsing if this is not a TCP packet. |
| |
| Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Reported-by: kernel test robot <lkp@intel.com> |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/netfilter/nft_osf.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c |
| index c261d57a666a..2c957629ea66 100644 |
| --- a/net/netfilter/nft_osf.c |
| +++ b/net/netfilter/nft_osf.c |
| @@ -28,6 +28,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs, |
| struct nf_osf_data data; |
| struct tcphdr _tcph; |
| |
| + if (pkt->tprot != IPPROTO_TCP) { |
| + regs->verdict.code = NFT_BREAK; |
| + return; |
| + } |
| + |
| tcp = skb_header_pointer(skb, ip_hdrlen(skb), |
| sizeof(struct tcphdr), &_tcph); |
| if (!tcp) { |
| -- |
| 2.30.2 |
| |
