Pablo Neira Ayuso f3f5ddeddd netfilter: nft_compat: validate chain type in match/target ...

We have to validate the real chain type to ensure that matches/targets
are not used out from their scope (eg. MASQUERADE in nat chain type).
The existing validation relies on the table name, but this is not
sufficient since userspace can fool us by using the appropriate table
name with a different chain type.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2014-10-18 14:14:07 +02:00

..

ipset

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2014-10-08 21:40:54 -04:00

ipvs

ipvs: Allow heterogeneous pools now that we support them

2014-09-18 08:59:29 +09:00

core.c

netfilter: HAVE_JUMP_LABEL instead of CONFIG_JUMP_LABEL

2014-08-25 10:45:28 +02:00

Kconfig

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-10-02 11:25:43 -07:00

Makefile

Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next

2014-09-10 12:46:32 -07:00

nf_conntrack_acct.c

netfilter: introduce nf_conn_acct structure

2013-11-03 21:48:49 +01:00

nf_conntrack_amanda.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

nf_conntrack_broadcast.c

netfilter: nf_conntrack: nf_conntrack snmp helper

2011-01-18 18:12:24 +01:00

nf_conntrack_core.c

net: use reciprocal_scale() helper

2014-08-23 12:21:21 -07:00

nf_conntrack_ecache.c

netfilter: conntrack: remove timer from ecache extension

2014-06-25 19:15:38 +02:00

nf_conntrack_expect.c

net: use reciprocal_scale() helper

2014-08-23 12:21:21 -07:00

nf_conntrack_extend.c

netfilter: nf_ct_ext: support variable length extensions

2012-06-16 15:08:49 +02:00

nf_conntrack_ftp.c

netfilter: Implement RFC 1123 for FTP conntrack

2013-05-27 13:32:43 +02:00

nf_conntrack_h323_asn1.c

netfilter: h323: bug in parsing of ASN1 SEQOF field

2011-04-04 15:21:02 +02:00

nf_conntrack_h323_main.c

netfilter: conntrack: seperate expect locking from nf_conntrack_lock

2014-03-07 11:41:01 +01:00

nf_conntrack_h323_types.c

[NETFILTER]: nf_conntrack_h323: constify and annotate H.323 helper

2008-01-31 19:28:07 -08:00

nf_conntrack_helper.c

netfilter: conntrack: remove central spinlock nf_conntrack_lock

2014-03-07 11:41:13 +01:00

nf_conntrack_irc.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

nf_conntrack_l3proto_generic.c

[NETFILTER]: nf_conntrack: use bool type in struct nf_conntrack_l3proto

2008-04-14 11:15:52 +02:00

nf_conntrack_labels.c

netfilter: connlabels: remove unneeded includes

2013-07-31 16:39:18 +02:00

nf_conntrack_netbios_ns.c

netfilter: nf_conntrack: nf_conntrack snmp helper

2011-01-18 18:12:24 +01:00

nf_conntrack_netlink.c

net: use ktime_get_ns() and ktime_get_real_ns() helpers

2014-08-22 19:57:23 -07:00

nf_conntrack_pptp.c

netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper

2014-04-08 10:56:12 +02:00

nf_conntrack_proto_dccp.c

netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages

2014-01-06 17:40:02 +01:00

nf_conntrack_proto_generic.c

netfilter: conntrack: disable generic tracking for known protocols

2014-09-29 12:17:49 +02:00

nf_conntrack_proto_gre.c

netfilter: nf_conntrack: flush net_gre->keymap_list only from gre helper

2014-04-08 10:56:12 +02:00

nf_conntrack_proto_sctp.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

nf_conntrack_proto_tcp.c

netfilter: add SYNPROXY core/target

2013-08-28 00:27:54 +02:00

nf_conntrack_proto_udp.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

nf_conntrack_proto_udplite.c

netfilter: nf_log: prepare net namespace support for loggers

2013-04-05 20:12:54 +02:00

nf_conntrack_proto.c

netfilter: nf_conntrack: remove dead code

2014-01-03 23:41:37 +01:00

nf_conntrack_sane.c

netfilter: nf_ct_helper: better logging for dropped packets

2013-02-19 02:48:05 +01:00

nf_conntrack_seqadj.c

netfilter: only warn once on wrong seqadj usage

2014-01-06 14:23:17 +01:00

nf_conntrack_sip.c

netfilter: conntrack: seperate expect locking from nf_conntrack_lock

2014-03-07 11:41:01 +01:00

nf_conntrack_snmp.c

netfilter: nf_ct_snmp: add include file

2013-01-18 00:28:18 +01:00

nf_conntrack_standalone.c

net: use ktime_get_ns() and ktime_get_real_ns() helpers

2014-08-22 19:57:23 -07:00

nf_conntrack_tftp.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

nf_conntrack_timeout.c

netfilter: nf_ct_timeout: move initialization out of pernet_operations

2013-01-23 12:56:02 +01:00

nf_conntrack_timestamp.c

netfilter: nf_ct_timestamp: Fix BUG_ON after netns deletion

2013-12-20 14:58:29 +01:00

nf_internals.h

net: misc: Remove extern from function prototypes

2013-10-19 19:12:11 -04:00

nf_log_common.c

netfilter: use IS_ENABLED(CONFIG_BRIDGE_NETFILTER)

2014-10-02 18:30:54 +02:00

nf_log.c

netfilter: bridge: add generic packet logger

2014-06-27 13:20:47 +02:00

nf_nat_amanda.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

nf_nat_core.c

net: use reciprocal_scale() helper

2014-08-23 12:21:21 -07:00

nf_nat_ftp.c

netfilter: nf_ct_helper: better logging for dropped packets

2013-02-19 02:48:05 +01:00

nf_nat_helper.c

netfilter: nf_conntrack: make sequence number adjustments usuable without NAT

2013-08-28 00:26:48 +02:00

nf_nat_irc.c

netfilter: nf_nat: fix access to uninitialized buffer in IRC NAT helper

2014-01-06 14:17:17 +01:00

nf_nat_proto_common.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_dccp.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_sctp.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_tcp.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_udp.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_udplite.c

netfilter: use IS_ENABLED() macro

2014-06-30 11:38:03 +02:00

nf_nat_proto_unknown.c

netfilter: add protocol independent NAT core

2012-08-30 03:00:14 +02:00

nf_nat_sip.c

netfilter: nf_ct_sip: consolidate NAT hook functions

2013-10-01 12:47:09 +02:00

nf_nat_tftp.c

netfilter: nf_ct_helper: better logging for dropped packets

2013-02-19 02:48:05 +01:00

nf_queue.c

netfilter: use IS_ENABLED(CONFIG_BRIDGE_NETFILTER)

2014-10-02 18:30:54 +02:00

nf_sockopt.c

netfilter: don't use mutex_lock_interruptible()

2014-08-08 16:47:23 +02:00

nf_synproxy_core.c

netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt

2014-02-05 17:46:06 +01:00

nf_tables_api.c

netfilter: nf_tables: restrict nat/masq expressions to nat chain type

2014-10-13 20:42:00 +02:00

nf_tables_core.c

netfilter: nf_tables: 64bit stats need some extra synchronization

2014-07-14 12:00:17 +02:00

nf_tables_inet.c

netfilter: nf_tables: fix error path in the init functions

2014-01-09 23:25:48 +01:00

nfnetlink_acct.c

netfilter: nfnetlink_acct: add filter support to nfacct counter list/reset

2014-08-26 21:36:19 +02:00

nfnetlink_cthelper.c

netfilter: check return code from nla_parse_tested

2013-06-20 11:20:13 +02:00

nfnetlink_cttimeout.c

netfilter: cttimeout: allow to set/get default protocol timeouts

2013-10-01 13:17:39 +02:00

nfnetlink_log.c

netfilter: use IS_ENABLED(CONFIG_BRIDGE_NETFILTER)

2014-10-02 18:30:54 +02:00

nfnetlink_queue_core.c

netfilter: use IS_ENABLED(CONFIG_BRIDGE_NETFILTER)

2014-10-02 18:30:54 +02:00

nfnetlink_queue_ct.c

netfilter: nf_conntrack: make sequence number adjustments usuable without NAT

2013-08-28 00:26:48 +02:00

nfnetlink.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-10-02 11:25:43 -07:00

nft_bitwise.c

netfilter: nf_tables: expression ops overloading

2013-10-14 17:16:08 +02:00

nft_byteorder.c

netfilter: nf_tables: expression ops overloading

2013-10-14 17:16:08 +02:00

nft_cmp.c

netfilter: nf_tables: fix nft_cmp_fast failure on big endian for size < 4

2014-04-14 10:38:02 +02:00

nft_compat.c

netfilter: nft_compat: validate chain type in match/target

2014-10-18 14:14:07 +02:00

nft_counter.c

netfilter: nf_tables: expression ops overloading

2013-10-14 17:16:08 +02:00

nft_ct.c

netfilter: nft_ct: split nft_ct_init() into two functions for get/set

2014-04-02 21:29:45 +02:00

nft_expr_template.c

netfilter: nf_tables: expression ops overloading

2013-10-14 17:16:08 +02:00

nft_exthdr.c

netfilter: nft_exthdr: call ipv6_find_hdr() with explicitly initialized offset

2013-12-20 11:25:10 +01:00

nft_hash.c

netfilter: nft_hash: no need for rcu in the hash set destroy path

2014-09-03 10:57:06 +02:00

nft_immediate.c

netfilter: nf_tables: restore context for expression destructors

2014-03-08 12:35:17 +01:00

nft_limit.c

netfilter: nf_tables: expression ops overloading

2013-10-14 17:16:08 +02:00

nft_log.c

netfilter: nft_log: fix coccinelle warnings

2014-06-29 13:55:08 +02:00

nft_lookup.c

netfilter: nf_tables: use new transaction infrastructure to handle sets

2014-05-19 12:06:10 +02:00

nft_masq.c

netfilter: nf_tables: restrict nat/masq expressions to nat chain type

2014-10-13 20:42:00 +02:00

nft_meta.c

netfilter: nf_tables: add devgroup support in meta expresion

2014-09-09 16:31:23 +02:00

nft_nat.c

netfilter: nf_tables: restrict nat/masq expressions to nat chain type

2014-10-13 20:42:00 +02:00

nft_payload.c

netfilter: nf_tables: check if payload length is a power of 2

2014-02-17 11:21:17 +01:00

nft_queue.c

netfilter: nf_tables: fix log/queue expressions for NFPROTO_INET

2014-02-06 11:41:38 +01:00

nft_rbtree.c

netfilter: nft_rbtree: no need for spinlock from set destroy path

2014-09-03 10:57:08 +02:00

nft_reject_inet.c

netfilter: nft_reject: introduce icmp code abstraction for inet and bridge

2014-10-02 18:29:57 +02:00

nft_reject.c

netfilter: fix wrong arithmetics regarding NFT_REJECT_ICMPX_MAX

2014-10-07 20:16:31 +02:00

x_tables.c

net/netfilter/x_tables.c: use __seq_open_private()

2014-09-26 18:42:29 +02:00

xt_addrtype.c

netfilter: xt_addrtype: fix trivial typo

2013-07-31 16:36:25 +02:00

xt_AUDIT.c

netfilter: Convert uses of __constant_<foo> to <foo>

2014-03-13 14:13:19 +01:00

xt_bpf.c

net: filter: split 'struct sk_filter' into socket and bpf parts

2014-08-02 15:03:58 -07:00

xt_cgroup.c

netfilter: x_tables: allow to use default cgroup match

2014-08-19 21:38:55 +02:00

xt_CHECKSUM.c

netfilter: add CHECKSUM target

2010-07-15 17:20:46 +02:00

xt_CLASSIFY.c

netfilter: xt_CLASSIFY: add ARP support, allow CLASSIFY target on any table

2010-11-15 13:57:56 +01:00

xt_cluster.c

net: use reciprocal_scale() helper

2014-08-23 12:21:21 -07:00

xt_comment.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_connbytes.c

netfilter: Convert pr_warning to pr_warn

2014-09-10 12:40:10 -07:00

xt_connlabel.c

netfilter: add connlabel conntrack extension

2013-01-18 00:28:15 +01:00

xt_connlimit.c

netfilter: connlimit: move lock array out of struct connlimit_data

2014-04-03 23:52:13 +02:00

xt_connmark.c

netfilter: Fix FSF address in file headers

2013-12-06 12:37:57 -05:00

xt_CONNSECMARK.c

netfilter: xtables: substitute temporary defines by final name

2010-05-11 18:31:17 +02:00

xt_conntrack.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

xt_cpu.c

netfilter: xtables: add missing aliases for autoloading via iptables

2011-01-18 06:33:54 +01:00

xt_CT.c

netfilter: nf_conntrack: don't release a conntrack with non-zero refcnt

2014-02-05 17:46:06 +01:00

xt_dccp.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

xt_devgroup.c

netfilter: xtables: add device group match

2011-02-03 00:05:43 +01:00

xt_dscp.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_DSCP.c

netfilter: IPv6: fix DSCP mangle code

2011-05-10 10:00:21 +02:00

xt_ecn.c

netfilter: xtables: collapse conditions in xt_ecn

2011-12-27 20:45:25 +01:00

xt_esp.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

xt_hashlimit.c

netfilter: Convert pr_warning to pr_warn

2014-09-10 12:40:10 -07:00

xt_helper.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_hl.c

netfilter: Reduce switch/case indent

2011-07-01 16:11:15 -07:00

xt_HL.c

netfilter: Reduce switch/case indent

2011-07-01 16:11:15 -07:00

xt_HMARK.c

net: use reciprocal_scale() helper

2014-08-23 12:21:21 -07:00

xt_IDLETIMER.c

netfilter: Remove unnecessary OOM logging messages

2011-11-01 09:19:49 +01:00

xt_ipcomp.c

netfilter: xt_ipcomp: Use ntohs to ease sparse warning

2014-02-19 11:41:25 +01:00

xt_iprange.c

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2011-02-04 14:28:58 -08:00

xt_ipvs.c

ipvs: API change to avoid rescan of IPv6 exthdr

2012-09-28 11:34:33 +09:00

xt_l2tp.c

netfilter: introduce l2tp match extension

2014-01-09 21:36:39 +01:00

xt_LED.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-08-05 18:46:26 -07:00

xt_length.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_limit.c

netfilter: add my copyright statements

2013-04-18 20:27:55 +02:00

xt_LOG.c

netfilter: xt_LOG: add missing string format in nf_log_packet()

2014-06-28 18:50:35 +02:00

xt_mac.c

netfilter: Convert compare_ether_addr to ether_addr_equal

2012-05-09 20:49:18 -04:00

xt_mark.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_multiport.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

xt_nat.c

netfilter: xt_nat: fix incorrect hooks for SNAT and DNAT targets

2012-10-15 13:39:12 +02:00

xt_NETMAP.c

netfilter: combine ipt_NETMAP and ip6t_NETMAP

2012-09-21 12:11:08 +02:00

xt_nfacct.c

netfilter: nfnetlink_acct: Adding quota support to accounting framework

2014-04-29 18:25:14 +02:00

xt_NFLOG.c

netfilter: log: netns NULL ptr bug when calling from conntrack

2013-05-15 14:11:07 +02:00

xt_NFQUEUE.c

netfilter: xt_NFQUEUE: separate reusable code

2013-12-07 23:20:45 +01:00

xt_osf.c

netfilter: Add {ipt,ip6t}_osf aliases for xt_osf

2014-04-03 23:52:22 +02:00

xt_owner.c

userns: xt_owner: Add basic user namespace support.

2012-08-14 21:55:30 -07:00

xt_physdev.c

netfilter: explicit module dependency between br_netfilter and physdev

2014-10-02 18:30:57 +02:00

xt_pkttype.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_policy.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_quota.c

net: Fix files explicitly needing to include module.h

2011-10-31 19:30:28 -04:00

xt_rateest.c

net_sched: add 64bit rate estimators

2013-06-11 02:51:03 -07:00

xt_RATEEST.c

net: sched: make bstats per cpu and estimator RCU safe

2014-09-30 01:02:26 -04:00

xt_realm.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00

xt_recent.c

net: use the new API kvfree()

2014-06-05 00:49:51 -07:00

xt_REDIRECT.c

netfilter: combine ipt_REDIRECT and ip6t_REDIRECT

2012-09-21 12:12:05 +02:00

xt_repldata.h

net: netfilter: LLVMLinux: vlais-netfilter

2014-06-07 11:44:39 -07:00

xt_sctp.c

netfilter: xt_sctp: use WORD_ROUND macro to calculate length of multiple of 4 bytes

2010-06-09 14:47:40 +02:00

xt_SECMARK.c

secmark: make secmark object handling generic

2010-10-21 10:12:48 +11:00

xt_set.c

netfilter: ipset: Add skbinfo extension support to SET target.

2014-09-15 22:20:21 +02:00

xt_socket.c

netfilter: xt_socket: use sock_gen_put()

2013-10-17 10:27:25 +02:00

xt_state.c

netfilter: nf_conntrack: IPS_UNTRACKED bit

2010-06-08 16:09:52 +02:00

xt_statistic.c

net: replace macros net_random and net_srandom with direct calls to prandom

2014-01-14 15:15:25 -08:00

xt_string.c

netfilter: xt_string: Remove unnecessary initialization of struct ts_state

2014-09-09 16:31:25 +02:00

xt_tcpmss.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

xt_TCPMSS.c

netfilter: xt_TCPMSS: lookup route from proper net namespace

2013-09-27 16:18:23 +02:00

xt_TCPOPTSTRIP.c

netfilter: xt_TCPOPTSTRIP: fix possible off by one access

2013-08-01 11:45:15 +02:00

xt_tcpudp.c

netfilter: xtables: change hotdrop pointer to direct modification

2010-05-11 18:35:27 +02:00

xt_TEE.c

net: pass info struct via netdevice notifier

2013-05-28 13:11:01 -07:00

xt_time.c

netfilter: xt_time: add support to ignore day transition

2012-09-24 14:29:01 +02:00

xt_TPROXY.c

ipv6: make lookups simpler and faster

2013-10-09 00:01:25 -04:00

xt_TRACE.c

netfilter: xtables: substitute temporary defines by final name

2010-05-11 18:31:17 +02:00

xt_u32.c

netfilter: xtables: deconstify struct xt_action_param for matches

2010-05-11 18:33:37 +02:00