@@ -184,6 +184,14 @@ static int nft_socket_init(const struct nft_ctx *ctx,
NULL, NFT_DATA_VALUE, len);
}
+static int nft_socket_validate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nft_data **data)
+{
+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_PRE_ROUTING) |
+ (1 << NF_INET_LOCAL_IN));
+}
+
static int nft_socket_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
@@ -230,6 +238,7 @@ static const struct nft_expr_ops nft_socket_ops = {
.size = NFT_EXPR_SIZE(sizeof(struct nft_socket)),
.eval = nft_socket_eval,
.init = nft_socket_init,
+ .validate = nft_socket_validate,
.dump = nft_socket_dump,
.reduce = nft_socket_reduce,
};
Just like xt_socket. Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nft_socket.c | 9 +++++++++ 1 file changed, 9 insertions(+)