Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5be3b97a authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nft_fwd_netdev: validate family and chain type 



commit 76a109fac206e158eb3c967af98c178cff738e6a upstream.

Make sure the forward action is only used from ingress.

Fixes: 39e6dea2 ("netfilter: nf_tables: add forward expression to the netdev family")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4e8bba94

net/netfilter/nft_fwd_netdev.c

+9 −0
Original line number Diff line number Diff line
@@ -190,6 +190,13 @@ static int nft_fwd_neigh_dump(struct sk_buff *skb, const struct nft_expr *expr) 
	return -1;

}



static int nft_fwd_validate(const struct nft_ctx *ctx,

			    const struct nft_expr *expr,

			    const struct nft_data **data)

{

	return nft_chain_validate_hooks(ctx->chain, (1 << NF_NETDEV_INGRESS));

}



static struct nft_expr_type nft_fwd_netdev_type;

static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = {

	.type		= &nft_fwd_netdev_type,
@@ -197,6 +204,7 @@ static const struct nft_expr_ops nft_fwd_neigh_netdev_ops = { 
	.eval		= nft_fwd_neigh_eval,

	.init		= nft_fwd_neigh_init,

	.dump		= nft_fwd_neigh_dump,

	.validate	= nft_fwd_validate,

};



static const struct nft_expr_ops nft_fwd_netdev_ops = {
@@ -205,6 +213,7 @@ static const struct nft_expr_ops nft_fwd_netdev_ops = { 
	.eval		= nft_fwd_netdev_eval,

	.init		= nft_fwd_netdev_init,

	.dump		= nft_fwd_netdev_dump,

	.validate	= nft_fwd_validate,

	.offload	= nft_fwd_netdev_offload,

};