On Wed, Jan 14, 2015 at 05:17:31PM +0000, Patrick McHardy wrote: > On 14.01, Pablo Neira Ayuso wrote: > > The user can crash the kernel if it configures the NAT chain in the > > wrong hook, so validate that the expression is used from the right > > hook when loading the rule. > > > > This patch introduces nft_chain_validate_hooks() which is based on > > existing code in the bridge version of the reject expression. > > But this will still allow use in non base chains that are called > from incorrect chains, right? The expression .validate callback should make sure that doesn't happen once you attach the non-base chain is "attached" to some base chain via jump/goto. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
