Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-11 14:42:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
cb81572e8c
linux/net/bridge/netfilter
History
Phil Sutter cb81572e8c netfilter: nf_tables: Make nft_meta expression more robust 
nft_meta_get_eval()'s tendency to bail out setting NFT_BREAK verdict in
situations where required data is missing leads to unexpected behaviour
with inverted checks like so:

| meta iifname != eth0 accept

This rule will never match if there is no input interface (or it is not
known) which is not intuitive and, what's worse, breaks consistency of
iptables-nft with iptables-legacy.

Fix this by falling back to placing a value in dreg which never matches
(avoiding accidental matches), i.e. zero for interface index and an
empty string for interface name.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2019-07-25 08:37:20 +02:00
..
ebt_802_3.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_among.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_arp.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_arpreply.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_dnat.c netfilter: bridge: convert skb_make_writable to skb_ensure_writable 2019-05-31 18:02:43 +02:00
ebt_ip6.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_ip.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_limit.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_log.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_mark_m.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_mark.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_nflog.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_pkttype.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_redirect.c netfilter: bridge: convert skb_make_writable to skb_ensure_writable 2019-05-31 18:02:43 +02:00
ebt_snat.c netfilter: bridge: convert skb_make_writable to skb_ensure_writable 2019-05-31 18:02:43 +02:00
ebt_stp.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebt_vlan.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13 2019-05-21 11:28:45 +02:00
ebtable_broute.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebtable_filter.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebtable_nat.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
ebtables.c netfilter: ebtables: fix a memory leak bug in compat 2019-07-21 21:00:15 +02:00
Kconfig netfilter: bridge: make NF_TABLES_BRIDGE tristate 2019-07-19 18:08:14 +02:00
Makefile netfilter: nft_meta: move bridge meta keys into nft_meta_bridge 2019-07-05 21:34:47 +02:00
nf_conntrack_bridge.c netfilter: bridge: Fix non-untagged fragment packet 2019-06-21 17:21:12 +02:00
nf_log_bridge.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
nft_meta_bridge.c netfilter: nf_tables: Make nft_meta expression more robust 2019-07-25 08:37:20 +02:00
nft_reject_bridge.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00