git.baikalelectronics.ru Git - kernel.git/commit

]> git.baikalelectronics.ru Git - kernel.git/commit

author	Pablo Neira Ayuso <pablo@netfilter.org>
	Wed, 14 Jan 2015 14:33:57 +0000 (15:33 +0100)
committer	Pablo Neira Ayuso <pablo@netfilter.org>
	Mon, 19 Jan 2015 13:52:39 +0000 (14:52 +0100)
commit	a44bc3cb17e619bdbd4d19634cfcf3d304b55f87
tree	64fcef16df64c35c2f3ceca20982d3723a2637c4	tree \| snapshot
parent	fdf3de34462a68cda99234584228297f7515bd96	commit \| diff

netfilter: nf_tables: validate hooks in NAT expressions

The user can crash the kernel if it uses any of the existing NAT
expressions from the wrong hook, so add some code to validate this
when loading the rule.

This patch introduces nft_chain_validate_hooks() which is based on
an existing function in the bridge version of the reject expression.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Linux Kernel Source Tree.

RSS Atom

include/net/netfilter/nf_tables.h		diff \| blob \| history
net/bridge/netfilter/nft_reject_bridge.c		diff \| blob \| history
net/netfilter/nf_tables_api.c		diff \| blob \| history
net/netfilter/nft_masq.c		diff \| blob \| history
net/netfilter/nft_nat.c		diff \| blob \| history
net/netfilter/nft_redir.c		diff \| blob \| history