mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
960fa72f67
"meta pkttype set" is only supported on prerouting chain with bridge
family and ingress chain with netdev family.
But the validate check is incomplete, and the user can add the nft
rules on input chain with bridge family, for example:
# nft add table bridge filter
# nft add chain bridge filter input {type filter hook input \
priority 0 \;}
# nft add chain bridge filter test
# nft add rule bridge filter test meta pkttype set unicast
# nft add rule bridge filter input jump test
This patch fixes the problem.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
43 lines
1.1 KiB
C
43 lines
1.1 KiB
C
#ifndef _NFT_META_H_
|
|
#define _NFT_META_H_
|
|
|
|
struct nft_meta {
|
|
enum nft_meta_keys key:8;
|
|
union {
|
|
enum nft_registers dreg:8;
|
|
enum nft_registers sreg:8;
|
|
};
|
|
};
|
|
|
|
extern const struct nla_policy nft_meta_policy[];
|
|
|
|
int nft_meta_get_init(const struct nft_ctx *ctx,
|
|
const struct nft_expr *expr,
|
|
const struct nlattr * const tb[]);
|
|
|
|
int nft_meta_set_init(const struct nft_ctx *ctx,
|
|
const struct nft_expr *expr,
|
|
const struct nlattr * const tb[]);
|
|
|
|
int nft_meta_get_dump(struct sk_buff *skb,
|
|
const struct nft_expr *expr);
|
|
|
|
int nft_meta_set_dump(struct sk_buff *skb,
|
|
const struct nft_expr *expr);
|
|
|
|
void nft_meta_get_eval(const struct nft_expr *expr,
|
|
struct nft_regs *regs,
|
|
const struct nft_pktinfo *pkt);
|
|
|
|
void nft_meta_set_eval(const struct nft_expr *expr,
|
|
struct nft_regs *regs,
|
|
const struct nft_pktinfo *pkt);
|
|
|
|
void nft_meta_set_destroy(const struct nft_ctx *ctx,
|
|
const struct nft_expr *expr);
|
|
|
|
int nft_meta_set_validate(const struct nft_ctx *ctx,
|
|
const struct nft_expr *expr,
|
|
const struct nft_data **data);
|
|
|
|
#endif
|