diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-08-21 16:25:07 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-09-05 10:27:41 +0200 |
| commit | fba05d25025675903e0ed179b7be06d31971e66e (patch) | |
| tree | 7565a0ef7b97915a56bf6d41f1cd8b870a15e94c /net | |
| parent | a2ce367ae743dd3b4d8fdb9945118df79ad07d42 (diff) | |
| download | linux-fba05d25025675903e0ed179b7be06d31971e66e.tar.gz linux-fba05d25025675903e0ed179b7be06d31971e66e.tar.bz2 linux-fba05d25025675903e0ed179b7be06d31971e66e.zip | |
netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families
[ Upstream commit 5f3b7aae14a706d0d7da9f9e39def52ff5fc3d39 ]
As it was originally intended, restrict extension to supported families.
Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nft_osf.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c index 4911f8eb394f..d966a3aff1d3 100644 --- a/net/netfilter/nft_osf.c +++ b/net/netfilter/nft_osf.c @@ -115,9 +115,21 @@ static int nft_osf_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, const struct nft_data **data) { - return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_LOCAL_IN) | - (1 << NF_INET_PRE_ROUTING) | - (1 << NF_INET_FORWARD)); + unsigned int hooks; + + switch (ctx->family) { + case NFPROTO_IPV4: + case NFPROTO_IPV6: + case NFPROTO_INET: + hooks = (1 << NF_INET_LOCAL_IN) | + (1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_FORWARD); + break; + default: + return -EOPNOTSUPP; + } + + return nft_chain_validate_hooks(ctx->chain, hooks); } static struct nft_expr_type nft_osf_type; |