Commit 76a109fa authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nft_fwd_netdev: validate family and chain type

Make sure the forward action is only used from ingress.

Fixes: 39e6dea2 ("netfilter: nf_tables: add forward expression to the netdev family")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 7c84d414
...@@ -190,6 +190,13 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, const struct nft_expr *expr) ...@@ -190,6 +190,13 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, const struct nft_expr *expr)
return -1; return -1;
} }
static int nft_fwd_validate(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nft_data **data)
{
return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));
}
static struct nft_expr_type nft_fwd_netdev_type; static struct nft_expr_type nft_fwd_netdev_type;
static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = { static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
.type = &nft_fwd_netdev_type, .type = &nft_fwd_netdev_type,
...@@ -197,6 +204,7 @@ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = { ...@@ -197,6 +204,7 @@ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {
.eval = nft_fwd_neigh_eval, .eval = nft_fwd_neigh_eval,
.init = nft_fwd_neigh_init, .init = nft_fwd_neigh_init,
.dump = nft_fwd_neigh_dump, .dump = nft_fwd_neigh_dump,
.validate = nft_fwd_validate,
}; };
static const struct nft_expr_ops nft_fwd_netdev_ops = { static const struct nft_expr_ops nft_fwd_netdev_ops = {
...@@ -205,6 +213,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = { ...@@ -205,6 +213,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = {
.eval = nft_fwd_netdev_eval, .eval = nft_fwd_netdev_eval,
.init = nft_fwd_netdev_init, .init = nft_fwd_netdev_init,
.dump = nft_fwd_netdev_dump, .dump = nft_fwd_netdev_dump,
.validate = nft_fwd_validate,
.offload = nft_fwd_netdev_offload, .offload = nft_fwd_netdev_offload,
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment