diff options
| author | Liping Zhang <liping.zhang@spreadtrum.com> | 2016-08-22 16:57:56 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-08-25 13:12:03 +0200 |
| commit | 960fa72f67f1be6891d63a5518860d1ae4e14b88 (patch) | |
| tree | 964e1af7530b7629961c4c825bd50629f73db81f /net/bridge | |
| parent | netfilter: cttimeout: unlink timeout objs in the unconfirmed ct lists (diff) | |
| download | linux-960fa72f67f1be6891d63a5518860d1ae4e14b88.tar.xz linux-960fa72f67f1be6891d63a5518860d1ae4e14b88.zip | |
netfilter: nft_meta: improve the validity check of pkttype set expr
"meta pkttype set" is only supported on prerouting chain with bridge
family and ingress chain with netdev family.
But the validate check is incomplete, and the user can add the nft
rules on input chain with bridge family, for example:
# nft add table bridge filter
# nft add chain bridge filter input {type filter hook input \
priority 0 \;}
# nft add chain bridge filter test
# nft add rule bridge filter test meta pkttype set unicast
# nft add rule bridge filter input jump test
This patch fixes the problem.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/bridge')
| -rw-r--r-- | net/bridge/netfilter/nft_meta_bridge.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c index 4b901d9f2e7c..ad47a921b701 100644 --- a/net/bridge/netfilter/nft_meta_bridge.c +++ b/net/bridge/netfilter/nft_meta_bridge.c @@ -86,6 +86,7 @@ static const struct nft_expr_ops nft_meta_bridge_set_ops = { .init = nft_meta_set_init, .destroy = nft_meta_set_destroy, .dump = nft_meta_set_dump, + .validate = nft_meta_set_validate, }; static const struct nft_expr_ops * |