On 14.01, Pablo Neira Ayuso wrote: > On Wed, Jan 14, 2015 at 05:45:00PM +0000, Patrick McHardy wrote: > > On 14.01, Pablo Neira Ayuso wrote: > > > On Wed, Jan 14, 2015 at 05:17:31PM +0000, Patrick McHardy wrote: > > > > On 14.01, Pablo Neira Ayuso wrote: > > > > > The user can crash the kernel if it configures the NAT chain in the > > > > > wrong hook, so validate that the expression is used from the right > > > > > hook when loading the rule. > > > > > > > > > > This patch introduces nft_chain_validate_hooks() which is based on > > > > > existing code in the bridge version of the reject expression. > > > > > > > > But this will still allow use in non base chains that are called > > > > from incorrect chains, right? > > > > > > The expression .validate callback should make sure that doesn't happen > > > once you attach the non-base chain is "attached" to some base chain > > > via jump/goto. > > > > How so? The nf_nat_validate_dependency() function simply returns 0 > > for non base chains. > > The validation is also called from nf_tables_check_loops(), using the > base chain at which the non-base chain has been attached to. Right, I missed that. Thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
