wgengine/filter: add check for unknown proto

Updates #14280 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2025-01-08 10:53:07 +01:00
parent f39ee8e520
commit f0b63d0eec
3 changed files with 10 additions and 1 deletions
@@ -621,6 +621,11 @@ func (f *Filter) pre(q *packet.Parsed, rf RunFlags, dir direction) (Response, us
 		return Drop, usermetric.ReasonTooShort
 	}

+	if q.IPProto == ipproto.Unknown {
+		f.logRateLimit(rf, q, dir, Drop, "unknown proto")
+		return Drop, usermetric.ReasonUnknownProtocol
+	}
+
 	if q.Dst.Addr().IsMulticast() {
 		f.logRateLimit(rf, q, dir, Drop, "multicast")
 		return Drop, usermetric.ReasonMulticast