projects / openwrt / staging / blogic.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 493618a) | patch
netfilter: nft_compat: validate chain type in match/target
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 14 Oct 2014 08:13:48 +0000 (10:13 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Sat, 18 Oct 2014 12:14:07 +0000 (14:14 +0200)
commitf3f5ddeddd6aeadcef523d55ea9288e3d5c1cbc3
tree8515ff30729229052cd91d69a49322424a05290btree | snapshot
parent493618a92c6afdd3f6224ab586f169d6a259bb06commit | diff
netfilter: nft_compat: validate chain type in match/target

We have to validate the real chain type to ensure that matches/targets
are not used out from their scope (eg. MASQUERADE in nat chain type).
The existing validation relies on the table name, but this is not
sufficient since userspace can fool us by using the appropriate table
name with a different chain type.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_compat.c diff | blob | history
John Crispins staging tree