tree 7e7678e27bded2e65072d96af8f9a227f5cca3ab
parent 77b337196a9d87f3d6bb9b07c0436ecafbffda1e
author Florian Westphal <fw@strlen.de> 1643472803 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1643949495 +0100

netfilter: nft_payload: don't allow th access for fragments

Loads relative to ->thoff naturally expect that this points to the
transport header, but this is only true if pkt->fragoff == 0.

This has little effect for rulesets with connection tracking/nat because
these enable ip defra. For other rulesets this prevents false matches.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>