On Wed, Feb 07, 2018 at 02:20:41PM +0100, Florian Westphal wrote: > This rejects rulesets where a jump occurs to a non-user defined chain. > This isn't limited in any way in the binary format (you can jump to > any rule you want within the blob structure), but iptables tools > do not offset such a feature. > > Sending as RFC as this limits features that might be used by programs > that don't call xtables(-restore) tools. > > This change also prevents the syzkaller reported crash as > ruleset gets rejected. My original intention was to go for this, given our official interface since the beginning has been iptables-restore. But given this description makes it clear that we have chance to break third applications relying on this binary layout, better go conservative and keep allowing this. My only concern so far is if this sort of flexibility, allowing us arbitrary jumps, can cause us more problems later on. Let me know, Thanks! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
