netfilter: xtables: check for unconditionality of policies

Browse source

This adds a check that iptables's original author Rusty set forth in
a FIXME comment.

Underflows in iptables are better known as chain policies, and are
required to be unconditional or there would be a stochastical chance
for the policy rule to be skipped if it does not match. If that were
to happen, rule execution would continue in an unexpected spurious
fashion.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

...

This commit is contained in:

Jan Engelhardt 2009-07-09 22:54:53 +02:00

parent a7d51738e7

commit 90e7d4ab5c

3 changed files with 21 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

net/ipv4/netfilter/arp_tables.c

View file

11

net/ipv4/netfilter/ip_tables.c

View file

12

net/ipv6/netfilter/ip6_tables.c

View file