On Wed, Apr 27, 2022 at 05:42:19PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > Looks like skb->sk is NULL? Patch attached.
>
> > diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
> > index 6d9e8e0a3a7d..d6da68a3b739 100644
> > --- a/net/netfilter/nft_socket.c
> > +++ b/net/netfilter/nft_socket.c
> > @@ -59,21 +59,27 @@ static void nft_socket_eval(const struct nft_expr *expr,
> > const struct nft_pktinfo *pkt)
> > {
> > const struct nft_socket *priv = nft_expr_priv(expr);
> > + u32 *dest = ®s->data[priv->dreg];
> > struct sk_buff *skb = pkt->skb;
> > + const struct net_device *dev;
> > struct sock *sk = skb->sk;
> > - u32 *dest = ®s->data[priv->dreg];
> >
> > if (sk && !net_eq(nft_net(pkt), sock_net(sk)))
> > sk = NULL;
> >
> > - if (!sk)
> > + if (nft_hook(pkt) == NF_INET_LOCAL_OUT)
> > + dev = nft_out(pkt);
> > + else
> > + dev = nft_in(pkt);
>
> I think its better to just NFT_BREAK for NF_INET_LOCAL_OUT && skb->sk == NULL,
> I don't see how nf_sk_lookup_slow_.() could provide meaningful result
> here, they assume packet header daddr/dport are the local, not the
> remote addresses.
>
> Or, check nft_in(pkt) == NULL || !sk -> BREAK, whatever seems simpler to
> you.
Makes sense.
I'll let you follow up on this.
I'll tag
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20220427153333.18424-1-pablo@xxxxxxxxxxxxx/
as changed requested too
