| commit | f3f5ddeddd6aeadcef523d55ea9288e3d5c1cbc3 | [log] [tgz] |
|---|---|---|
| author | Pablo Neira Ayuso <pablo@netfilter.org> | Tue Oct 14 10:13:48 2014 +0200 |
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | Sat Oct 18 14:14:07 2014 +0200 |
| tree | 8515ff30729229052cd91d69a49322424a05290b | |
| parent | 493618a92c6afdd3f6224ab586f169d6a259bb06 [diff] |
netfilter: nft_compat: validate chain type in match/target We have to validate the real chain type to ensure that matches/targets are not used out from their scope (eg. MASQUERADE in nat chain type). The existing validation relies on the table name, but this is not sufficient since userspace can fool us by using the appropriate table name with a different chain type. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>