diff options
| author |   Pablo Neira Ayuso <pablo@netfilter.org> | 2020-10-29 13:50:03 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-10-30 12:57:39 +0100 |
| commit | c0391b6ab810381df632677a1dcbbbbd63d05b6d (patch) | |
| tree | fdb037178fcf70bac3b76a02de79de161229ae78 /tools/testing/selftests | |
| parent | netfilter: use actual socket sk rather than skb sk when routing harder (diff) | |
| download | wireguard-linux-c0391b6ab810381df632677a1dcbbbbd63d05b6d.tar.xz wireguard-linux-c0391b6ab810381df632677a1dcbbbbd63d05b6d.zip | |
netfilter: nf_tables: missing validation from the abort path
If userspace does not include the trailing end of batch message, then
nfnetlink aborts the transaction. This allows to check that ruleset
updates trigger no errors.
After this patch, invoking this command from the prerouting chain:
# nft -c add rule x y fib saddr . oif type local
fails since oif is not supported there.
This patch fixes the lack of rule validation from the abort/check path
to catch configuration errors such as the one above.
Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'tools/testing/selftests')
0 files changed, 0 insertions, 0 deletions