On 14.01, Pablo Neira Ayuso wrote: > On Wed, Jan 14, 2015 at 05:17:31PM +0000, Patrick McHardy wrote: > > On 14.01, Pablo Neira Ayuso wrote: > > > The user can crash the kernel if it configures the NAT chain in the > > > wrong hook, so validate that the expression is used from the right > > > hook when loading the rule. > > > > > > This patch introduces nft_chain_validate_hooks() which is based on > > > existing code in the bridge version of the reject expression. > > > > But this will still allow use in non base chains that are called > > from incorrect chains, right? > > The expression .validate callback should make sure that doesn't happen > once you attach the non-base chain is "attached" to some base chain > via jump/goto. How so? The nf_nat_validate_dependency() function simply returns 0 for non base chains. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
