On 14.01, Pablo Neira Ayuso wrote: > The user can crash the kernel if it configures the NAT chain in the > wrong hook, so validate that the expression is used from the right > hook when loading the rule. > > This patch introduces nft_chain_validate_hooks() which is based on > existing code in the bridge version of the reject expression. But this will still allow use in non base chains that are called from incorrect chains, right? -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
