summaryrefslogtreecommitdiffstats
path: root/net/ipv6/xfrm6_output.c
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2019-11-12 17:14:37 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2019-11-15 23:44:48 +0100
commit28f8bfd1ac948403ebd5c8070ae1e25421560059 (patch)
tree8e5b472d45954ee16b7fb7d172bb394058b3268d /net/ipv6/xfrm6_output.c
parent5c27d8d76ce810c6254cf5917a6019d824f34bd2 (diff)
downloadlinux-stable-28f8bfd1ac948403ebd5c8070ae1e25421560059.tar.gz
linux-stable-28f8bfd1ac948403ebd5c8070ae1e25421560059.tar.bz2
linux-stable-28f8bfd1ac948403ebd5c8070ae1e25421560059.zip
netfilter: Support iif matches in POSTROUTING
Instead of generally passing NULL to NF_HOOK_COND() for input device, pass skb->dev which contains input device for routed skbs. Note that iptables (both legacy and nft) reject rules with input interface match from being added to POSTROUTING chains, but nftables allows this. Cc: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6/xfrm6_output.c')
-rw-r--r--net/ipv6/xfrm6_output.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index eecac1b7148e..fbe51d40bd7e 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -187,7 +187,7 @@ skip_frag:
int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
{
return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
- net, sk, skb, NULL, skb_dst(skb)->dev,
+ net, sk, skb, skb->dev, skb_dst(skb)->dev,
__xfrm6_output,
!(IP6CB(skb)->flags & IP6SKB_REROUTED));
}