Re: [PATCH v3 1/1] netfilter: nat: add a range check for l3/l4 protonum

On Fri, Aug 28, 2020 at 06:45:51PM +0200, Florian Westphal wrote:

Pablo Neira Ayuso [off-list ref] wrote:

quoted

Hi Will,

Given this is for -stable maintainers only, I'd suggest:

1) Specify what -stable kernel versions this patch applies to.
   Explain that this problem is gone since what kernel version.

2) Maybe clarify that this is only for stable in the patch subject,
   e.g. [PATCH -stable v3] netfilter: nat: add a range check for l3/l4

Hmm, we silently accept a tuple that we can't really deal with, no?

Oh, I overlook, existing kernels are affected. You're right.

quoted

quoted

+	if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
+		return -EOPNOTSUPP;

I vote to apply this to nf.git

I have rebased this patch on top of nf.git, attached what I'll apply
to nf.git.