Pablo Neira Ayuso a654de8fdc netfilter: nf_tables: fix chain dependency validation ... The following ruleset: add table ip filter add chain ip filter input { type filter hook input priority 4; } add chain ip filter ap add rule ip filter input jump ap add rule ip filter ap masquerade results in a panic, because the masquerade extension should be rejected from the filter chain. The existing validation is missing a chain dependency check when the rule is added to the non-base chain. This patch fixes the problem by walking down the rules from the basechains, searching for either immediate or lookup expressions, then jumping to non-base chains and again walking down the rules to perform the expression validation, so we make sure the full ruleset graph is validated. This is done only once from the commit phase, in case of problem, we abort the transaction and perform fine grain validation for error reporting. This patch requires 003087911a ("netfilter: nfnetlink: allow commit to fail") to achieve this behaviour. This patch also adds a cleanup callback to nfnl batch interface to reset the validate state from the exit path. As a result of this patch, nf_tables_check_loops() doesn't use ->validate to check for loops, instead it just checks for immediate expressions. Reported-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2018-06-01 09:46:22 +02:00
..
can.h	can: af_can: give struct holding the CAN per device receive lists a sensible name	2018-01-05 11:12:08 +01:00
conntrack.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
core.h	sock: Hide unused variable when !CONFIG_PROC_FS.	2017-12-19 09:58:14 -05:00
dccp.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
generic.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
hash.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ieee802154_6lowpan.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ipv4.h	tcp: add tcp_comp_sack_nr sysctl	2018-05-18 11:40:27 -04:00
ipv6.h	ipv6: sr: Compute flowlabel for outer IPv6 header of seg6 encap mode	2018-04-25 13:02:15 -04:00
mib.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mpls.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netfilter.h	netfilter: don't allocate space for arp/bridge hooks unless needed	2018-01-08 18:01:11 +01:00
nftables.h	netfilter: nf_tables: fix chain dependency validation	2018-06-01 09:46:22 +02:00
packet.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
sctp.h	sctp: add stream interleave enable members and sockopt	2017-12-11 11:23:04 -05:00
unix.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
x_tables.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xfrm.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00