Re: [PATCH net] nfnetlink_osf: validate individual option lengths in fingerprints

[Florian Westphal]

bestswngs@xxxxxxxxx <bestswngs@xxxxxxxxx> wrote:
> From: Weiming Shi <bestswngs@xxxxxxxxx>
> 
> nfnl_osf_add_callback() validates opt_num bounds and string
> NUL-termination but does not check individual option length fields.
> A zero-length option causes nf_osf_match_one() to enter the option
> matching loop even when foptsize sums to zero, which matches packets
> with no TCP options where ctx->optp is NULL:

Applied, thanks.

How many people still use this feature?
Does this even work reliably in 2026?

I'm considering deprecation notice + eventual removal of this feature.