From: Daniel Borkmann <dborkman@redhat.com>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf-next] netfilter: ct: check return code from nla_parse_tested
Date: Thu, 20 Jun 2013 11:47:48 +0200 [thread overview]
Message-ID: <51C2CFC4.4020302@redhat.com> (raw)
In-Reply-To: <20130620094500.GA6225@localhost>
On 06/20/2013 11:45 AM, Pablo Neira Ayuso wrote:
> On Wed, Jun 12, 2013 at 05:54:51PM +0200, Daniel Borkmann wrote:
>> These are the only calls under net/ that do not check nla_parse_nested()
>> for its error code, but simply continue execution. If parsing of netlink
>> attributes fails, we should return with an error instead of continuing.
>> In nearly all of these calls we have a policy attached, that is being
>> type verified during nla_parse_nested(), which we would miss checking
>> for otherwise.
>
> Applied, thanks Daniel.
>
> I'm going to run some tests, this may uncover wrong policies as they
> were not enforced.
Ok, sounds good, thanks Pablo !
prev parent reply other threads:[~2013-06-20 9:47 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-12 15:54 [PATCH nf-next] netfilter: ct: check return code from nla_parse_tested Daniel Borkmann
2013-06-20 9:45 ` Pablo Neira Ayuso
2013-06-20 9:47 ` Daniel Borkmann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51C2CFC4.4020302@redhat.com \
--to=dborkman@redhat.com \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.