NFT_REJECT_ICMPX_MAX should be __NFT_REJECT_ICMPX_MAX - 1. nft_reject_icmp_code() and nft_reject_icmpv6_code() are called from the packet path, so BUG_ON in case we try to access an unknown abstracted ICMP code. This should not happen since we already validate this from nft_reject_{inet,bridge}_init().
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -774,7 +774,7 @@ enum nft_reject_inet_code { · 773 unmodified lines | |||
| 774 | NFT_REJECT_ICMPX_ADMIN_PROHIBITED, | 774 | NFT_REJECT_ICMPX_ADMIN_PROHIBITED, |
| 775 | __NFT_REJECT_ICMPX_MAX | 775 | __NFT_REJECT_ICMPX_MAX |
| 776 | }; | 776 | }; |
| 777 | #define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX + 1) | 777 | #define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX - 1) |
| 778 | 778 | ||
| 779 | /** | 779 | /** |
| 780 | * enum nft_reject_attributes - nf_tables reject expression netlink attributes | 780 | * enum nft_reject_attributes - nf_tables reject expression netlink attributes |