]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 1e17841) | patch
netfilter: nf_tables: disallow jump to implicit chain from set element
authorPablo Neira Ayuso <pablo@netfilter.org>
Mon, 8 Aug 2022 17:30:07 +0000 (19:30 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 9 Aug 2022 18:13:29 +0000 (20:13 +0200)
commita3a86ece7e35d697dc7871543889ce8eb8a83e52
treee4e3c8b186ad39a11535e21ec4c374906fa03ef4tree | snapshot
parent1e17841ee35a38967583ca7bb4c8b3b6394cca95commit | diff
netfilter: nf_tables: disallow jump to implicit chain from set element

Extend struct nft_data_desc to add a flag field that specifies
nft_data_init() is being called for set element data.

Use it to disallow jump to implicit chain from set element, only jump
to chain via immediate expression is allowed.

Fixes: 5ac41f4b815c ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
include/net/netfilter/nf_tables.h diff | blob | history
net/netfilter/nf_tables_api.c diff | blob | history
Linux Kernel Source Tree.