Re: [PATCH nf] netfilter: nf_tables: validate hooks in NAT expressions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 14.01, Pablo Neira Ayuso wrote:
> On Wed, Jan 14, 2015 at 05:45:00PM +0000, Patrick McHardy wrote:
> > On 14.01, Pablo Neira Ayuso wrote:
> > > On Wed, Jan 14, 2015 at 05:17:31PM +0000, Patrick McHardy wrote:
> > > > On 14.01, Pablo Neira Ayuso wrote:
> > > > > The user can crash the kernel if it configures the NAT chain in the
> > > > > wrong hook, so validate that the expression is used from the right
> > > > > hook when loading the rule.
> > > > > 
> > > > > This patch introduces nft_chain_validate_hooks() which is based on
> > > > > existing code in the bridge version of the reject expression.
> > > > 
> > > > But this will still allow use in non base chains that are called
> > > > from incorrect chains, right?
> > > 
> > > The expression .validate callback should make sure that doesn't happen
> > > once you attach the non-base chain is "attached" to some base chain
> > > via jump/goto.
> > 
> > How so? The nf_nat_validate_dependency() function simply returns 0
> > for non base chains.
> 
> The validation is also called from nf_tables_check_loops(), using the
> base chain at which the non-base chain has been attached to.

Right, I missed that. Thanks!
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux