netfilter: nf_tables: fix wrong datatype in nft_validate_data_load()
This patch fixes dictionary mappings, eg. add rule ip filter input meta dnat set tcp dport map { 22 => 1.1.1.1, 23 => 2.2.2.2 } The kernel was returning -EINVAL in nft_validate_data_load() since the type of the set element data that is passed was the real userspace datatype instead of NFT_DATA_VALUE. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
d201297561
commit
2ee0d3c80f
|
@ -2382,7 +2382,9 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
|
|||
enum nft_registers dreg;
|
||||
|
||||
dreg = nft_type_to_reg(set->dtype);
|
||||
return nft_validate_data_load(ctx, dreg, &elem->data, set->dtype);
|
||||
return nft_validate_data_load(ctx, dreg, &elem->data,
|
||||
set->dtype == NFT_DATA_VERDICT ?
|
||||
NFT_DATA_VERDICT : NFT_DATA_VALUE);
|
||||
}
|
||||
|
||||
int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
|
||||
|
|
Loading…
Reference in a new issue