mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 22:54:01 +00:00
netfilter: nft_fwd_netdev: validate family and chain type
Make sure the forward action is only used from ingress.
Fixes: 39e6dea28a
("netfilter: nf_tables: add forward expression to the netdev family")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
7c84d41416
commit
76a109fac2
1 changed files with 9 additions and 0 deletions
|
@ -190,6 +190,13 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, const struct nft_expr *expr)
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int nft_fwd_validate(const struct nft_ctx *ctx,
|
||||||
|
const struct nft_expr *expr,
|
||||||
|
const struct nft_data **data)
|
||||||
|
{
|
||||||
|
return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
|
||||||
|
}
|
||||||
|
|
||||||
static struct nft_expr_type nft_fwd_netdev_type;
|
static struct nft_expr_type nft_fwd_netdev_type;
|
||||||
static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
|
static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
|
||||||
.type = &nft_fwd_netdev_type,
|
.type = &nft_fwd_netdev_type,
|
||||||
|
@ -197,6 +204,7 @@ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
|
||||||
.eval = nft_fwd_neigh_eval,
|
.eval = nft_fwd_neigh_eval,
|
||||||
.init = nft_fwd_neigh_init,
|
.init = nft_fwd_neigh_init,
|
||||||
.dump = nft_fwd_neigh_dump,
|
.dump = nft_fwd_neigh_dump,
|
||||||
|
.validate = nft_fwd_validate,
|
||||||
};
|
};
|
||||||
|
|
||||||
static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
||||||
|
@ -205,6 +213,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
||||||
.eval = nft_fwd_netdev_eval,
|
.eval = nft_fwd_netdev_eval,
|
||||||
.init = nft_fwd_netdev_init,
|
.init = nft_fwd_netdev_init,
|
||||||
.dump = nft_fwd_netdev_dump,
|
.dump = nft_fwd_netdev_dump,
|
||||||
|
.validate = nft_fwd_validate,
|
||||||
.offload = nft_fwd_netdev_offload,
|
.offload = nft_fwd_netdev_offload,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue