netfilter: nf_tables: validate NFPROTO_* family
[ Upstream commit d0009eff ] Several expressions explicitly refer to NF_INET_* hook definitions from expr->ops->validate, however, family is not validated. Bail out with EOPNOTSUPP in case they are used from unsupported families. Fixes: 0ca743a5 ("netfilter: nf_tables: add compatibility layer for x_tables") Fixes: a3c90f7a ("netfilter: nf_tables: flow offload expression") Fixes: 2fa84193 ("netfilter: nf_tables: introduce routing expression") Fixes: 554ced0a ("netfilter: nf_tables: add support for native socket matching") Fixes: ad49d86e ("netfilter: nf_tables: Add synproxy support") Fixes: 4ed8eb65 ("netfilter: nf_tables: Add native tproxy support") Fixes: 6c472602 ("netfilter: nf_tables: add xfrm expression") Signed-off-by:Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
18f1f505
Please register or sign in to comment