diff mbox series

[nf,v2,2/2] netfilter: nft_osf: check for TCP packet before further processing

Message ID 20210616184005.120570-2-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show
Series [nf,v2,1/2] netfilter: nft_exthdr: check for IPv6 packet before further processing | expand

Commit Message

Pablo Neira Ayuso June 16, 2021, 6:40 p.m. UTC
The osf expression only supports for TCP packets, add a upfront sanity
check to skip packet parsing if this is not a TCP packet.

Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
v2: fix kbuild report.

 net/netfilter/nft_osf.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series


diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
index ac61f708b82d..d82677e83400 100644
--- a/net/netfilter/nft_osf.c
+++ b/net/netfilter/nft_osf.c
@@ -28,6 +28,11 @@  static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,
 	struct nf_osf_data data;
 	struct tcphdr _tcph;
+	if (pkt->tprot != IPPROTO_TCP) {
+		regs->verdict.code = NFT_BREAK;
+		return;
+	}
 	tcp = skb_header_pointer(skb, ip_hdrlen(skb),
 				 sizeof(struct tcphdr), &_tcph);
 	if (!tcp) {