netfilter: nf_tables: accept QUEUE/DROP verdict parameters (e0abdadc) · Commits · 戴 / test

net/netfilter/nf_tables_api.c

+10 −5

Original line number	Diff line number	Diff line
		@@ -3174,9 +3174,16 @@ static int nft_verdict_init(const struct nft_ctx ctx, struct nft_data data,
		data->verdict = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));

		switch (data->verdict) {
		default:
		switch (data->verdict & NF_VERDICT_MASK) {
		case NF_ACCEPT:
		case NF_DROP:
		case NF_QUEUE:
		break;
		default:
		return -EINVAL;
		}
		/* fall through */
		case NFT_CONTINUE:
		case NFT_BREAK:
		case NFT_RETURN:
		@@ -3197,8 +3204,6 @@ static int nft_verdict_init(const struct nft_ctx ctx, struct nft_data data,
		data->chain = chain;
		desc->len = sizeof(data);
		break;
		default:
		return -EINVAL;
		}

		desc->type = NFT_DATA_VERDICT;