Commit 8f518d43 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_osf: check for TCP packet before further processing 



The osf expression only supports for TCP packets, add a upfront sanity
check to skip packet parsing if this is not a TCP packet.

Fixes: b96af92d ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Reported-by: default avatarkernel test robot <lkp@intel.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cdd73cc5

net/netfilter/nft_osf.c

+5 −0
Original line number Diff line number Diff line
@@ -28,6 +28,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs, 
	struct nf_osf_data data;

	struct tcphdr _tcph;



	if (pkt->tprot != IPPROTO_TCP) {

		regs->verdict.code = NFT_BREAK;

		return;

	}



	tcp = skb_header_pointer(skb, ip_hdrlen(skb),

				 sizeof(struct tcphdr), &_tcph);

	if (!tcp) {