iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
b00e5334ab
linux/net/bridge/netfilter
History
Phil Sutter bcf4934288 netfilter: ebtables: Fix extension lookup with identical name 
If a requested extension exists as module and is not loaded,
ebt_check_match() might accidentally use an NFPROTO_UNSPEC one with same
name and fail.

Reproduced with limit match: Given xt_limit and ebt_limit both built as
module, the following would fail:

  modprobe xt_limit
  ebtables -I INPUT --limit 1/s -j ACCEPT

The fix is to make ebt_check_match() distrust a found NFPROTO_UNSPEC
extension and retry after requesting an appropriate module.

Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-04-13 01:16:57 +02:00
..
ebt_802_3.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
ebt_among.c bridge: netfilter: Use ether_addr_copy 2014-02-24 19:16:44 -05:00
ebt_arp.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
ebt_arpreply.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
ebt_dnat.c bridge: netfilter: Use ether_addr_copy 2014-02-24 19:16:44 -05:00
ebt_ip6.c netfilter-bridge: layout of if statements 2015-11-23 17:54:41 +01:00
ebt_ip.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
ebt_limit.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
ebt_log.c netfilter-bridge: brace placement 2015-11-23 17:54:40 +01:00
ebt_mark_m.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
ebt_mark.c netfilter: xtables: substitute temporary defines by final name 2010-05-11 18:31:17 +02:00
ebt_nflog.c netfilter: x_tables: Use par->net instead of computing from the passed net devices 2015-09-18 21:58:25 +02:00
ebt_pkttype.c netfilter: xtables: deconstify struct xt_action_param for matches 2010-05-11 18:33:37 +02:00
ebt_redirect.c bridge: netfilter: Use ether_addr_copy 2014-02-24 19:16:44 -05:00
ebt_snat.c bridge: netfilter: Use ether_addr_copy 2014-02-24 19:16:44 -05:00
ebt_stp.c netfilter-bridge: Cleanse indentation 2015-11-23 17:54:39 +01:00
ebt_vlan.c netfilter-bridge: use netdev style comments 2015-11-23 17:54:39 +01:00
ebtable_broute.c netfilter: ebtables: Simplify the arguments to ebt_do_table 2015-09-18 21:57:35 +02:00
ebtable_filter.c netfilter-bridge: Cleanse indentation 2015-11-23 17:54:39 +01:00
ebtable_nat.c netfilter-bridge: Cleanse indentation 2015-11-23 17:54:39 +01:00
ebtables.c netfilter: ebtables: Fix extension lookup with identical name 2016-04-13 01:16:57 +02:00
Kconfig netfilter: bridge: add reject support 2014-07-22 12:00:22 +02:00
Makefile netfilter: kill remnants of ulog targets 2014-07-25 14:55:44 +02:00
nf_log_bridge.c netfilter: bridge: add generic packet logger 2014-06-27 13:20:47 +02:00
nf_tables_bridge.c netfilter: nf_tables: release objects on netns destruction 2015-12-28 18:34:35 +01:00
nft_meta_bridge.c netfilter: nf_tables: wrap tracing with a static key 2015-12-09 13:23:13 +01:00
nft_reject_bridge.c netfilter: ipv4: fix NULL dereference 2016-03-28 17:59:29 +02:00