mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 16:37:50 +00:00
netfilter: nft_fwd_netdev: validate family and chain type
commit76a109fac2
upstream. Make sure the forward action is only used from ingress. Fixes:39e6dea28a
("netfilter: nf_tables: add forward expression to the netdev family") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
dc0ea9b710
commit
ba2bc76526
1 changed files with 8 additions and 0 deletions
|
@ -62,6 +62,13 @@ static int nft_fwd_netdev_dump(struct sk_buff *skb, const struct nft_expr *expr)
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int nft_fwd_validate(const struct nft_ctx *ctx,
|
||||||
|
const struct nft_expr *expr,
|
||||||
|
const struct nft_data **data)
|
||||||
|
{
|
||||||
|
return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
|
||||||
|
}
|
||||||
|
|
||||||
static struct nft_expr_type nft_fwd_netdev_type;
|
static struct nft_expr_type nft_fwd_netdev_type;
|
||||||
static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
||||||
.type = &nft_fwd_netdev_type,
|
.type = &nft_fwd_netdev_type,
|
||||||
|
@ -69,6 +76,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
||||||
.eval = nft_fwd_netdev_eval,
|
.eval = nft_fwd_netdev_eval,
|
||||||
.init = nft_fwd_netdev_init,
|
.init = nft_fwd_netdev_init,
|
||||||
.dump = nft_fwd_netdev_dump,
|
.dump = nft_fwd_netdev_dump,
|
||||||
|
.validate = nft_fwd_validate,
|
||||||
};
|
};
|
||||||
|
|
||||||
static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {
|
static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {
|
||||||
|
|
Loading…
Reference in a new issue