]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 435fa82) | patch
netfilter: nf_tables: disallow jump to implicit chain from set element
authorPablo Neira Ayuso <pablo@netfilter.org>
Mon, 8 Aug 2022 17:30:07 +0000 (19:30 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 9 Aug 2022 18:13:29 +0000 (20:13 +0200)
commit9d44fc338a7304cd604ead76d4ca72845084a94f
treee4e3c8b186ad39a11535e21ec4c374906fa03ef4tree | snapshot
parent435fa8254b3aa597f688921669bf7fd6f52c16f1commit | diff
netfilter: nf_tables: disallow jump to implicit chain from set element

Extend struct nft_data_desc to add a flag field that specifies
nft_data_init() is being called for set element data.

Use it to disallow jump to implicit chain from set element, only jump
to chain via immediate expression is allowed.

Fixes: 2afcd17bdf11 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/nf_tables.h diff | blob | history
net/netfilter/nf_tables_api.c diff | blob | history
Linux Kernel Source Tree.