diff options
| author | Eric Garver <eric@garver.life> | 2024-05-21 17:25:05 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-06-12 12:12:58 +0300 |
| commit | 61134e41db2354426574986f2b27b4af2e268468 (patch) | |
| tree | dfbb02f6b73ca699dd6c4c7d4f9ff237999979e6 /net/netfilter | |
| parent | 570b4c52096e62fda562448f5760fd0ff06110f0 (diff) | |
| download | linux-61134e41db2354426574986f2b27b4af2e268468.tar.xz | |
netfilter: nft_fib: allow from forward/input without iif selector
[ Upstream commit e8ded22ef0f4831279c363c264cd41cd9d59ca9e ]
This removes the restriction of needing iif selector in the
forward/input hooks for fib lookups when requested result is
oif/oifname.
Removing this restriction allows "loose" lookups from the forward hooks.
Fixes: be8be04e5ddb ("netfilter: nft_fib: reverse path filter for policy-based routing on iif")
Signed-off-by: Eric Garver <eric@garver.life>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_fib.c | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c index ca905aa8227e..bf825f6cb974 100644 --- a/net/netfilter/nft_fib.c +++ b/net/netfilter/nft_fib.c @@ -35,11 +35,9 @@ int nft_fib_validate(const struct nft_ctx *ctx, const struct nft_expr *expr, switch (priv->result) { case NFT_FIB_RESULT_OIF: case NFT_FIB_RESULT_OIFNAME: - hooks = (1 << NF_INET_PRE_ROUTING); - if (priv->flags & NFTA_FIB_F_IIF) { - hooks |= (1 << NF_INET_LOCAL_IN) | - (1 << NF_INET_FORWARD); - } + hooks = (1 << NF_INET_PRE_ROUTING) | + (1 << NF_INET_LOCAL_IN) | + (1 << NF_INET_FORWARD); break; case NFT_FIB_RESULT_ADDRTYPE: if (priv->flags & NFTA_FIB_F_IIF) |