OpenE2K/linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
ce8ec48967
linux/net/ipv6/netfilter
History
Pablo Neira Ayuso 7210e4e38f netfilter: nf_tables: restrict nat/masq expressions to nat chain type 
This adds the missing validation code to avoid the use of nat/masq from
non-nat chains. The validation assumes two possible configuration
scenarios:

1) Use of nat from base chain that is not of nat type. Reject this
   configuration from the nft_*_init() path of the expression.

2) Use of nat from non-base chain. In this case, we have to wait until
   the non-base chain is referenced by at least one base chain via
   jump/goto. This is resolved from the nft_*_validate() path which is
   called from nf_tables_check_loops().

The user gets an -EOPNOTSUPP in both cases.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2014-10-13 20:42:00 +02:00
..
ip6_tables.c netfilter: Can't fail and free after table replacement 2014-04-05 17:46:22 +02:00
ip6t_ah.c
ip6t_eui64.c
ip6t_frag.c
ip6t_hbh.c
ip6t_ipv6header.c netfilter: remove unnecessary break after return 2014-07-15 16:27:00 -07:00
ip6t_MASQUERADE.c netfilter: nf_nat: generalize IPv6 masquerading support for nf_tables 2014-09-09 16:31:29 +02:00
ip6t_mh.c
ip6t_NPT.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-04-07 18:37:01 -04:00
ip6t_REJECT.c netfilter: REJECT: separate reusable code 2013-12-30 15:04:41 +01:00
ip6t_rpfilter.c net: ipv6: more places need LOOPBACK_IFINDEX for flowi6_iif 2014-04-28 14:47:03 -04:00
ip6t_rt.c
ip6t_SYNPROXY.c netfilter: SYNPROXY target: restrict to INPUT/FORWARD 2013-12-11 11:30:25 +01:00
ip6table_filter.c netfilter: pass hook ops to hookfn 2013-10-14 11:29:31 +02:00
ip6table_mangle.c netfilter: pass hook ops to hookfn 2013-10-14 11:29:31 +02:00
ip6table_nat.c netfilter: nat: move specific NAT IPv6 to core 2014-09-09 16:30:00 +02:00
ip6table_raw.c netfilter: pass hook ops to hookfn 2013-10-14 11:29:31 +02:00
ip6table_security.c netfilter: pass hook ops to hookfn 2013-10-14 11:29:31 +02:00
Kconfig netfilter: move nf_send_resetX() code to nf_reject_ipvX modules 2014-10-02 18:30:49 +02:00
Makefile netfilter: move nf_send_resetX() code to nf_reject_ipvX modules 2014-10-02 18:30:49 +02:00
nf_conntrack_l3proto_ipv6.c netfilter: push reasm skb through instead of original frag skbs 2013-11-11 00:19:35 -05:00
nf_conntrack_proto_icmpv6.c netfilter: nf_log: prepare net namespace support for loggers 2013-04-05 20:12:54 +02:00
nf_conntrack_reasm.c inet: frags: use kmem_cache for inet_frag_queue 2014-08-02 15:31:31 -07:00
nf_defrag_ipv6_hooks.c netfilter: use IS_ENABLED(CONFIG_BRIDGE_NETFILTER) 2014-10-02 18:30:54 +02:00
nf_log_ipv6.c netfilter: log: nf_log_packet() as real unified interface 2014-06-27 13:20:13 +02:00
nf_nat_l3proto_ipv6.c netfilter: nat: move specific NAT IPv6 to core 2014-09-09 16:30:00 +02:00
nf_nat_masquerade_ipv6.c netfilter: nf_nat: generalize IPv6 masquerading support for nf_tables 2014-09-09 16:31:29 +02:00
nf_nat_proto_icmpv6.c netfilter: nf_nat_proto_icmpv6:: fix wrong comparison in icmpv6_manip_pkt 2013-09-13 11:58:48 +02:00
nf_reject_ipv6.c netfilter: missing module license in the nf_reject_ipvX modules 2014-10-11 14:59:41 +02:00
nf_tables_ipv6.c netfilter: nf_tables: fix error path in the init functions 2014-01-09 23:25:48 +01:00
nft_chain_nat_ipv6.c netfilter: nft_chain_nat_ipv6: use generic IPv6 NAT code from core 2014-09-09 16:31:09 +02:00
nft_chain_route_ipv6.c netfilter: nf_tables: rename nft_do_chain_pktinfo() to nft_do_chain() 2014-01-09 20:17:16 +01:00
nft_masq_ipv6.c netfilter: nf_tables: restrict nat/masq expressions to nat chain type 2014-10-13 20:42:00 +02:00
nft_reject_ipv6.c netfilter: nf_tables: add reject module for NFPROTO_INET 2014-02-06 09:44:18 +01:00