leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7c6b0d76fa
linux/include/net/netfilter
History
Liping Zhang 960fa72f67 netfilter: nft_meta: improve the validity check of pkttype set expr 
"meta pkttype set" is only supported on prerouting chain with bridge
family and ingress chain with netdev family.

But the validate check is incomplete, and the user can add the nft
rules on input chain with bridge family, for example:
  # nft add table bridge filter
  # nft add chain bridge filter input {type filter hook input \
    priority 0 \;}
  # nft add chain bridge filter test
  # nft add rule bridge filter test meta pkttype set unicast
  # nft add rule bridge filter input jump test

This patch fixes the problem.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2016-08-25 13:12:03 +02:00
..
ipv4 ipv4: Push struct net down into nf_send_reset 2015-09-29 20:21:31 +02:00
ipv6 netfilter: ipv6: avoid nf_iterate recursion 2015-11-23 17:54:45 +01:00
br_netfilter.h bridge: Pass net into br_validate_ipv4 and br_validate_ipv6 2015-09-29 20:21:32 +02:00
nf_conntrack_acct.h netfilter: introduce nf_conn_acct structure 2013-11-03 21:48:49 +01:00
nf_conntrack_core.h netfilter: conntrack: fix race between nf_conntrack proc read and hash resize 2016-07-11 11:38:57 +02:00
nf_conntrack_ecache.h netfilter: conntrack: move expectation event helper to ecache.c 2016-04-12 23:01:57 +02:00
nf_conntrack_expect.h netfilter: conntrack: use a single expectation table for all namespaces 2016-05-06 11:50:01 +02:00
nf_conntrack_extend.h netfilter: move nat hlist_head to nf_conn 2016-07-11 11:47:50 +02:00
nf_conntrack_helper.h netfilter: Add helper array register/unregister functions 2016-07-21 02:31:53 +02:00
nf_conntrack_l3proto.h netfilter: Convert print_tuple functions to return void 2014-11-05 14:10:33 -05:00
nf_conntrack_l4proto.h netfilter: conntrack: introduce clash resolution on insertion race 2016-05-05 16:39:50 +02:00
nf_conntrack_labels.h netfilter: connlabels: move set helper to xt_connlabel 2016-07-22 17:05:10 +02:00
nf_conntrack_seqadj.h netfilter: Remove extern from function prototypes 2013-09-23 16:29:42 -04:00
nf_conntrack_synproxy.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-10-01 17:06:14 -04:00
nf_conntrack_timeout.h netfilter: cttimeout: add netns support 2015-12-14 12:48:58 +01:00
nf_conntrack_timestamp.h netfilter: Remove extern from function prototypes 2013-09-23 16:29:42 -04:00
nf_conntrack_tuple.h netfilter: nf_nat: export NAT definitions to userspace 2011-12-23 14:36:43 +01:00
nf_conntrack_zones.h netfilter: move zone info into struct nf_conn 2016-06-23 13:33:12 +02:00
nf_conntrack.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2016-07-24 22:02:36 -07:00
nf_dup_netdev.h netfilter: nf_tables: add packet duplication to the netdev family 2016-01-03 21:04:23 +01:00
nf_log.h netfilter: xt_NFLOG: nflog-range does not truncate packets 2016-06-24 11:03:23 +02:00
nf_nat_core.h netfilter: Pass net into nf_xfrm_me_harder 2015-09-18 22:00:22 +02:00
nf_nat_helper.h netfilter: Remove extern from function prototypes 2013-09-23 16:29:42 -04:00
nf_nat_l3proto.h netfilter: Pass priv instead of nf_hook_ops to netfilter hooks 2015-09-18 22:00:16 +02:00
nf_nat_l4proto.h netfilter: Remove extern from function prototypes 2013-09-23 16:29:42 -04:00
nf_nat_redirect.h netfilter: combine IPv4 and IPv6 nf_nat_redirect code in one module 2014-11-27 13:08:42 +01:00
nf_nat.h netfilter: nat: convert nat bysrc hash to rhashtable 2016-07-11 12:07:57 +02:00
nf_queue.h netfilter: nf_queue: Make the queue_handler pernet 2016-05-25 11:54:22 +02:00
nf_tables_bridge.h netfilter: nf_tables_bridge: export nft_reject_ip*hdr_validate functions 2014-11-27 12:58:05 +01:00
nf_tables_core.h netfilter: nf_tables: wrap tracing with a static key 2015-12-09 13:23:13 +01:00
nf_tables_ipv4.h netfilter: nf_tables: kill nft_pktinfo.ops 2015-09-18 21:58:01 +02:00
nf_tables_ipv6.h netfilter: nf_tables: kill nft_pktinfo.ops 2015-09-18 21:58:01 +02:00
nf_tables.h netfilter: nf_tables: get rid of possible_net_t from set and basechain 2016-07-11 12:16:04 +02:00
nfnetlink_log.h netfilter: log: netns NULL ptr bug when calling from conntrack 2013-05-15 14:11:07 +02:00
nft_dup.h netfilter: nf_tables: add nft_dup expression 2015-08-07 11:49:49 +02:00
nft_masq.h netfilter: nft_masq: support port range 2016-03-02 20:05:27 +01:00
nft_meta.h netfilter: nft_meta: improve the validity check of pkttype set expr 2016-08-25 13:12:03 +02:00
nft_redir.h netfilter: nf_tables: add new expression nft_redir 2014-10-27 22:49:39 +01:00
nft_reject.h netfilter: nft_reject: restrict to INPUT/FORWARD/OUTPUT 2016-08-25 12:55:34 +02:00
xt_rateest.h netfilter: Remove extern from function prototypes 2013-09-23 16:29:42 -04:00