summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorLiping Zhang <liping.zhang@spreadtrum.com>2016-08-22 16:57:56 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2016-08-25 13:12:03 +0200
commit960fa72f67f1be6891d63a5518860d1ae4e14b88 (patch)
tree964e1af7530b7629961c4c825bd50629f73db81f /include
parentnetfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists (diff)
downloadlinux-960fa72f67f1be6891d63a5518860d1ae4e14b88.tar.xz
linux-960fa72f67f1be6891d63a5518860d1ae4e14b88.zip
netfilter: nft_meta: improve the validity check of pkttype set expr
"meta pkttype set" is only supported on prerouting chain with bridge family and ingress chain with netdev family. But the validate check is incomplete, and the user can add the nft rules on input chain with bridge family, for example: # nft add table bridge filter # nft add chain bridge filter input {type filter hook input \ priority 0 \;} # nft add chain bridge filter test # nft add rule bridge filter test meta pkttype set unicast # nft add rule bridge filter input jump test This patch fixes the problem. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include')
-rw-r--r--include/net/netfilter/nft_meta.h4
1 files changed, 4 insertions, 0 deletions
diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
index d27588c8dbd9..1139cde0fdc5 100644
--- a/include/net/netfilter/nft_meta.h
+++ b/include/net/netfilter/nft_meta.h
@@ -36,4 +36,8 @@ void nft_meta_set_eval(const struct nft_expr *expr,
void nft_meta_set_destroy(const struct nft_ctx *ctx,
const struct nft_expr *expr);
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nft_data **data);
+
#endif