mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 16:37:50 +00:00
netfilter: nft_fwd_netdev: validate family and chain type
commit76a109fac2
upstream. Make sure the forward action is only used from ingress. Fixes:39e6dea28a
("netfilter: nf_tables: add forward expression to the netdev family") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
dc0ea9b710
commit
ba2bc76526
1 changed files with 8 additions and 0 deletions
|
@ -62,6 +62,13 @@ static int nft_fwd_netdev_dump(struct sk_buff *skb, const struct nft_expr *expr)
|
|||
return -1;
|
||||
}
|
||||
|
||||
static int nft_fwd_validate(const struct nft_ctx *ctx,
|
||||
const struct nft_expr *expr,
|
||||
const struct nft_data **data)
|
||||
{
|
||||
return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
|
||||
}
|
||||
|
||||
static struct nft_expr_type nft_fwd_netdev_type;
|
||||
static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
||||
.type = &nft_fwd_netdev_type,
|
||||
|
@ -69,6 +76,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = {
|
|||
.eval = nft_fwd_netdev_eval,
|
||||
.init = nft_fwd_netdev_init,
|
||||
.dump = nft_fwd_netdev_dump,
|
||||
.validate = nft_fwd_validate,
|
||||
};
|
||||
|
||||
static struct nft_expr_type nft_fwd_netdev_type __read_mostly = {
|
||||
|
|
Loading…
Reference in a new issue