Pablo Neira Ayuso 6301a73bd8 netfilter: nf_tables: disallow jump to implicit chain from set element ...

[ Upstream commit f323ef3a0d ]

Extend struct nft_data_desc to add a flag field that specifies
nft_data_init() is being called for set element data.

Use it to disallow jump to implicit chain from set element, only jump
to chain via immediate expression is allowed.

Fixes: d0e2c7de92 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-08-31 17:15:18 +02:00

..

ipv4

…

ipv6

…

br_netfilter.h

…

nf_conntrack_acct.h

…

nf_conntrack_bridge.h

…

nf_conntrack_core.h

netfilter: conntrack: re-fetch conntrack after insertion

2022-06-06 08:42:43 +02:00

nf_conntrack_count.h

…

nf_conntrack_ecache.h

…

nf_conntrack_expect.h

…

nf_conntrack_extend.h

…

nf_conntrack_helper.h

…

nf_conntrack_l4proto.h

…

nf_conntrack_labels.h

…

nf_conntrack_seqadj.h

…

nf_conntrack_synproxy.h

…

nf_conntrack_timeout.h

…

nf_conntrack_timestamp.h

…

nf_conntrack_tuple.h

…

nf_conntrack_zones.h

…

nf_conntrack.h

…

nf_dup_netdev.h

…

nf_flow_table.h

…

nf_log.h

…

nf_nat_helper.h

…

nf_nat_masquerade.h

…

nf_nat_redirect.h

…

nf_nat.h

…

nf_queue.h

netfilter: nf_queue: fix possible use-after-free

2022-03-08 19:09:33 +01:00

nf_reject.h

…

nf_socket.h

…

nf_synproxy.h

…

nf_tables_core.h

netfilter: nft_cmp: optimize comparison for 16-bytes

2022-08-31 17:15:18 +02:00

nf_tables_ipv4.h

…

nf_tables_ipv6.h

…

nf_tables_offload.h

netfilter: nf_tables: bail out early if hardware offload is not supported

2022-06-14 18:32:40 +02:00

nf_tables.h

netfilter: nf_tables: disallow jump to implicit chain from set element

2022-08-31 17:15:18 +02:00

nf_tproxy.h

…

nft_fib.h

netfilter: nftables: add nft_parse_register_store() and use it

2022-06-29 08:59:46 +02:00

nft_meta.h

netfilter: nftables: add nft_parse_register_store() and use it

2022-06-29 08:59:46 +02:00

nft_reject.h

…

xt_rateest.h

…