9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
48 lines
1.5 KiB
Diff
48 lines
1.5 KiB
Diff
From dc881297140fa0d80136180c1e2e1d66c5adac44 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:22:15 +0200
|
|
Subject: [PATCH] netfilter: nft_osf: restrict it to ipv4
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit b336fdbb7103
|
|
|
|
commit b336fdbb7103fb1484e1dcb6741151d4b5a41e35
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Tue Apr 14 13:06:38 2026 +0200
|
|
|
|
netfilter: nft_osf: restrict it to ipv4
|
|
|
|
This expression only supports for ipv4, restrict it.
|
|
|
|
Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf")
|
|
Acked-by: Florian Westphal <fw@strlen.de>
|
|
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c
|
|
index 1c0b493..bdc2f6c 100644
|
|
--- a/net/netfilter/nft_osf.c
|
|
+++ b/net/netfilter/nft_osf.c
|
|
@@ -28,6 +28,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs,
|
|
struct nf_osf_data data;
|
|
struct tcphdr _tcph;
|
|
|
|
+ if (nft_pf(pkt) != NFPROTO_IPV4) {
|
|
+ regs->verdict.code = NFT_BREAK;
|
|
+ return;
|
|
+ }
|
|
+
|
|
if (pkt->tprot != IPPROTO_TCP) {
|
|
regs->verdict.code = NFT_BREAK;
|
|
return;
|
|
@@ -114,7 +119,6 @@ static int nft_osf_validate(const struct nft_ctx *ctx,
|
|
|
|
switch (ctx->family) {
|
|
case NFPROTO_IPV4:
|
|
- case NFPROTO_IPV6:
|
|
case NFPROTO_INET:
|
|
hooks = (1 << NF_INET_LOCAL_IN) |
|
|
(1 << NF_INET_PRE_ROUTING) |
|