Just like xt_socket.
Fixes: 554ced0a6e29 ("netfilter: nf_tables: add support for native socket matching")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
net/netfilter/nft_socket.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index 6d9e8e0a3a7d..963a09fd7174 100644
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -184,6 +184,14 @@ static int nft_socket_init(const struct nft_ctx *ctx,
NULL, NFT_DATA_VALUE, len);
}
+static int nft_socket_validate(const struct nft_ctx *ctx,
+ const struct nft_expr *expr,
+ const struct nft_data **data)
+{
+ return nft_chain_validate_hooks(ctx->chain, (1 << NF_INET_PRE_ROUTING) |
+ (1 << NF_INET_LOCAL_IN));
+}
+
static int nft_socket_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
@@ -230,6 +238,7 @@ static const struct nft_expr_ops nft_socket_ops = {
.size = NFT_EXPR_SIZE(sizeof(struct nft_socket)),
.eval = nft_socket_eval,
.init = nft_socket_init,
+ .validate = nft_socket_validate,
.dump = nft_socket_dump,
.reduce = nft_socket_reduce,
};
--
2.30.2
