netfilter: nf_tables: validate catch-all set elements

Browse source

[ Upstream commit d46fc89414 ]

catch-all set element might jump/goto to chain that uses expressions
that require validation.

Fixes: aaa31047a6 ("netfilter: nftables: add catch-all set element support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Pablo Neira Ayuso 2023-04-17 12:14:29 +02:00 • committed by Greg Kroah-Hartman

parent 8a5dad80bd

commit ef87cd8132

3 changed files with 66 additions and 38 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

include/net/netfilter/nf_tables.h

View file