diff options
| author | Florian Westphal <[email protected]> | 2024-03-01 12:38:15 +0000 |
|---|---|---|
| committer | Pablo Neira Ayuso <[email protected]> | 2024-03-06 23:12:34 +0000 |
| commit | 99993789966a6eb4f1295193dc543686899892d3 (patch) | |
| tree | 106d115e32ca9786de5365af5ac21aa5892e4cae /drivers/net/ethernet/intel/igc/igc_main.c | |
| parent | netfilter: nf_tables: reject constant set with timeout (diff) | |
| download | kernel-99993789966a6eb4f1295193dc543686899892d3.tar.gz kernel-99993789966a6eb4f1295193dc543686899892d3.zip | |
netfilter: nft_ct: fix l3num expectations with inet pseudo family
Following is rejected but should be allowed:
table inet t {
ct expectation exp1 {
[..]
l3proto ip
Valid combos are:
table ip t, l3proto ip
table ip6 t, l3proto ip6
table inet t, l3proto ip OR l3proto ip6
Disallow inet pseudeo family, the l3num must be a on-wire protocol known
to conntrack.
Retain NFPROTO_INET case to make it clear its rejected
intentionally rather as oversight.
Fixes: 8059918a1377 ("netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations")
Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Pablo Neira Ayuso <[email protected]>
Diffstat (limited to 'drivers/net/ethernet/intel/igc/igc_main.c')
0 files changed, 0 insertions, 0 deletions