diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-10-13 12:35:47 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-10-13 16:49:07 +0200 |
| commit | b4775dec9f80b74c522edec8ebb4af5092e0e82b (patch) | |
| tree | 89131c377e3a9b137931b6663847ae06d19bc668 /src/evaluate.c | |
| parent | 4eb71b2fe5ca0b65cbe47b4a33cefe4c7862e018 (diff) | |
src: ingress inet support
Add support for inet ingress chains.
table inet filter {
chain ingress {
type filter hook ingress device "veth0" priority filter; policy accept;
}
chain input {
type filter hook input priority filter; policy accept;
}
chain forward {
type filter hook forward priority filter; policy accept;
}
}
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/evaluate.c')
| -rw-r--r-- | src/evaluate.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/evaluate.c b/src/evaluate.c index 5f17d750..abbf83ae 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -3965,10 +3965,12 @@ static uint32_t str2hooknum(uint32_t family, const char *hook) return NF_INET_NUMHOOKS; switch (family) { + case NFPROTO_INET: + if (!strcmp(hook, "ingress")) + return NF_INET_INGRESS; case NFPROTO_IPV4: case NFPROTO_BRIDGE: case NFPROTO_IPV6: - case NFPROTO_INET: /* These families have overlapping values for each hook */ if (!strcmp(hook, "prerouting")) return NF_INET_PRE_ROUTING; @@ -4042,7 +4044,9 @@ static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) expr_name(chain->policy)); } - if (chain->handle.family == NFPROTO_NETDEV) { + if (chain->handle.family == NFPROTO_NETDEV || + (chain->handle.family == NFPROTO_INET && + chain->hook.num == NF_INET_INGRESS)) { if (!chain->dev_expr) return __stmt_binary_error(ctx, &chain->loc, NULL, "Missing `device' in this chain definition"); |