[PATCH net-next,RFC 08/13] netfilter: nft_chain_filter: add support for early ingress
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2018-06-14 14:20:22
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
This patch adds the new filter chain at the early ingress hook. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> --- net/netfilter/nft_chain_filter.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 84c902477a91..bc7fb2dc0e44 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c@@ -277,9 +277,11 @@ static const struct nft_chain_type nft_chain_filter_netdev = { .name = "filter", .type = NFT_CHAIN_T_DEFAULT, .family = NFPROTO_NETDEV, - .hook_mask = (1 << NF_NETDEV_INGRESS), + .hook_mask = (1 << NF_NETDEV_INGRESS) | + (1 << NF_NETDEV_EARLY_INGRESS), .hooks = { - [NF_NETDEV_INGRESS] = nft_do_chain_netdev, + [NF_NETDEV_INGRESS] = nft_do_chain_netdev, + [NF_NETDEV_EARLY_INGRESS] = nft_do_chain_netdev, }, };
--
2.11.0