diff options
| author | Serhey Popovych <serhe.popovych@gmail.com> | 2018-06-05 11:46:13 +0200 |
|---|---|---|
| committer | Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> | 2018-06-06 14:00:41 +0200 |
| commit | 9dcceb1378b6d66633f613805b2d5a22af4d5383 (patch) | |
| tree | 2edd91f2929ac129ac3a47b83ce639a34b5e6edf /net | |
| parent | ipvs: fix check on xmit to non-local addresses (diff) | |
| download | linux-9dcceb1378b6d66633f613805b2d5a22af4d5383.tar.xz linux-9dcceb1378b6d66633f613805b2d5a22af4d5383.zip | |
netfilter: xt_set: Check hook mask correctly
Inserting rule before one with SET target we get error with warning in
dmesg(1) output:
# iptables -A FORWARD -t mangle -j SET --map-set test src --map-prio
# iptables -I FORWARD 1 -t mangle -j ACCEPT
iptables: Invalid argument. Run `dmesg' for more information.
# dmesg |tail -n1
[268578.026643] mapping of prio or/and queue is allowed only from \
OUTPUT/FORWARD/POSTROUTING chains
Rather than checking for supported hook bits for SET target check for
unsupported one as done in all rest of matches and targets.
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/xt_set.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c index 6f4c5217d835..07af7dbf7a30 100644 --- a/net/netfilter/xt_set.c +++ b/net/netfilter/xt_set.c @@ -470,7 +470,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par) } if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) | (info->flags & IPSET_FLAG_MAP_SKBQUEUE)) && - !(par->hook_mask & (1 << NF_INET_FORWARD | + (par->hook_mask & ~(1 << NF_INET_FORWARD | 1 << NF_INET_LOCAL_OUT | 1 << NF_INET_POST_ROUTING))) { pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n"); |