Re: [nf-next PATCH] netfilter: nft_exthdr: Search chunks in SCTP packets only

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Phil,

On Thu, Jun 10, 2021 at 04:23:16PM +0200, Phil Sutter wrote:
> Since user space does not generate a payload dependency, plain sctp
> chunk matches cause searching in non-SCTP packets, too. Avoid this
> potential mis-interpretation of packet data by checking pkt->tprot.
> 
> Fixes: 133dc203d77df ("netfilter: nft_exthdr: Support SCTP chunks")
> Signed-off-by: Phil Sutter <phil@nwl.cc>
> ---
>  net/netfilter/nft_exthdr.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
> index 7f705b5c09de8..1093bb83f8aeb 100644
> --- a/net/netfilter/nft_exthdr.c
> +++ b/net/netfilter/nft_exthdr.c
> @@ -312,6 +312,9 @@ static void nft_exthdr_sctp_eval(const struct nft_expr *expr,
>  	const struct sctp_chunkhdr *sch;
>  	struct sctp_chunkhdr _sch;
>  
> +	if (!pkt->tprot_set || pkt->tprot != IPPROTO_SCTP)
> +		goto err;

nft_set_pktinfo_unspec() already initializes pkt->tprot to zero.

I think it's safe to simplify this to:

	if (pkt->tprot != IPPROTO_SCTP)