Re: [PATCH nf] netfilter: nf_tables: validate hooks in NAT expressions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 14.01, Pablo Neira Ayuso wrote:
> On Wed, Jan 14, 2015 at 05:17:31PM +0000, Patrick McHardy wrote:
> > On 14.01, Pablo Neira Ayuso wrote:
> > > The user can crash the kernel if it configures the NAT chain in the
> > > wrong hook, so validate that the expression is used from the right
> > > hook when loading the rule.
> > > 
> > > This patch introduces nft_chain_validate_hooks() which is based on
> > > existing code in the bridge version of the reject expression.
> > 
> > But this will still allow use in non base chains that are called
> > from incorrect chains, right?
> 
> The expression .validate callback should make sure that doesn't happen
> once you attach the non-base chain is "attached" to some base chain
> via jump/goto.

How so? The nf_nat_validate_dependency() function simply returns 0
for non base chains.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux