iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: only allow in/output for arp packets

Browse Source 
arp packets cannot be forwarded.

They can be bridged, but then they can be filtered using
either ebtables or nftables bridge family.

The bridge netfilter exposes a "call-arptables" switch which
pushes packets into arptables, but lets not expose this for nftables, so better
close this asap.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2017-07-07 13:29:03 +02:00 committed by Pablo Neira Ayuso
parent 97772bcd56
commit 974292defe
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/ipv4/netfilter/nf_tables_arp.c
View File

@ -72,8 +72,7 @@ static const struct nf_chain_type filter_arp = {
.family = NFPROTO_ARP, .family = NFPROTO_ARP,
.owner = THIS_MODULE, .owner = THIS_MODULE,
.hook_mask = (1 << NF_ARP_IN) | .hook_mask = (1 << NF_ARP_IN) |
(1 << NF_ARP_OUT) | (1 << NF_ARP_OUT),
(1 << NF_ARP_FORWARD),
}; };
static int __init nf_tables_arp_init(void) static int __init nf_tables_arp_init(void)