Re: [PATCH nf] netfilter: nf_tables: validate hooks in NAT expressions

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jan 14, 2015 at 05:45:00PM +0000, Patrick McHardy wrote:
> On 14.01, Pablo Neira Ayuso wrote:
> > On Wed, Jan 14, 2015 at 05:17:31PM +0000, Patrick McHardy wrote:
> > > On 14.01, Pablo Neira Ayuso wrote:
> > > > The user can crash the kernel if it configures the NAT chain in the
> > > > wrong hook, so validate that the expression is used from the right
> > > > hook when loading the rule.
> > > > 
> > > > This patch introduces nft_chain_validate_hooks() which is based on
> > > > existing code in the bridge version of the reject expression.
> > > 
> > > But this will still allow use in non base chains that are called
> > > from incorrect chains, right?
> > 
> > The expression .validate callback should make sure that doesn't happen
> > once you attach the non-base chain is "attached" to some base chain
> > via jump/goto.
> 
> How so? The nf_nat_validate_dependency() function simply returns 0
> for non base chains.

The validation is also called from nf_tables_check_loops(), using the
base chain at which the non-base chain has been attached to.