Hi Phil,
On Thu, Jun 10, 2021 at 04:23:16PM +0200, Phil Sutter wrote:
> Since user space does not generate a payload dependency, plain sctp
> chunk matches cause searching in non-SCTP packets, too. Avoid this
> potential mis-interpretation of packet data by checking pkt->tprot.
>
> Fixes: 133dc203d77df ("netfilter: nft_exthdr: Support SCTP chunks")
> Signed-off-by: Phil Sutter <phil@xxxxxx>
> ---
> net/netfilter/nft_exthdr.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
> index 7f705b5c09de8..1093bb83f8aeb 100644
> --- a/net/netfilter/nft_exthdr.c
> +++ b/net/netfilter/nft_exthdr.c
> @@ -312,6 +312,9 @@ static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
> const struct sctp_chunkhdr *sch;
> struct sctp_chunkhdr _sch;
>
> + if (!pkt->tprot_set || pkt->tprot != IPPROTO_SCTP)
> + goto err;
nft_set_pktinfo_unspec() already initializes pkt->tprot to zero.
I think it's safe to simplify this to:
if (pkt->tprot != IPPROTO_SCTP)
