netfilter: allow to turn off xtables compat layer

Browse source

The compat layer needs to parse untrusted input (the ruleset)
to translate it to a 64bit compatible format.

We had a number of bugs in this department in the past, so allow users
to turn this feature off.

Add CONFIG_NETFILTER_XTABLES_COMPAT kconfig knob and make it default to y
to keep existing behaviour.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Florian Westphal 2021-04-26 12:14:40 +02:00 • committed by Pablo Neira Ayuso

parent 50f2db9e36

commit 47a6959fa3

15 changed files with 70 additions and 60 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

include/linux/netfilter/x_tables.h

View file

2

include/linux/netfilter_arp/arp_tables.h

View file

2

include/linux/netfilter_ipv4/ip_tables.h

View file

2

include/linux/netfilter_ipv6/ip6_tables.h

View file