History

netfilter: nf_tables: reject unsupported chain flags

Bail out if userspace sends unsupported chain flags.

Pablo Neira Ayuso committed 6 years ago

Commit c1f79a21 parent d0e2c7d2 files · +6 −0Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+3−0
@@ -189,6 +189,9 @@ enum nft_chain_flags { · 188 unmodified lines
189 NFT_CHAIN_HW_OFFLOAD = (1 << 1),189 NFT_CHAIN_HW_OFFLOAD = (1 << 1),
190 NFT_CHAIN_BINDING = (1 << 2),190 NFT_CHAIN_BINDING = (1 << 2),
191};191};
192#define NFT_CHAIN_FLAGS (NFT_CHAIN_BASE | \
193 NFT_CHAIN_HW_OFFLOAD | \
194 NFT_CHAIN_BINDING)
192 195
193/**196/**
194 * enum nft_chain_attributes - nf_tables chain netlink attributes197 * enum nft_chain_attributes - nf_tables chain netlink attributes