From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 10 Nov 2014 19:53:55 +0000 (+0100)
Subject: netfilter: nft_compat: relax chain type validation
X-Git-Tag: omap-for-v3.19/fixes-for-merge-window~83^2~20^2~3
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c918687f5e3962375a19de6ded3c1be85ebdbcd6;p=pandora-kernel.git

netfilter: nft_compat: relax chain type validation

Check for nat chain dependency only, which is the one that can
actually crash the kernel. Don't care if mangle, filter and security
specific match and targets are used out of their scope, they are
harmless.

This restores iptables-compat with mangle specific match/target when
used out of the OUTPUT chain, that are actually emulated through filter
chains, which broke when performing strict validation.

Fixes: f3f5dde ("netfilter: nft_compat: validate chain type in match/target")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

Reading git-diff-tree failed