| commit | 28f8bfd1ac948403ebd5c8070ae1e25421560059 | [log] [tgz] |
|---|---|---|
| author | Phil Sutter <phil@nwl.cc> | Tue Nov 12 17:14:37 2019 +0100 |
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | Fri Nov 15 23:44:48 2019 +0100 |
| tree | 8e5b472d45954ee16b7fb7d172bb394058b3268d | |
| parent | 5c27d8d76ce810c6254cf5917a6019d824f34bd2 [diff] |
netfilter: Support iif matches in POSTROUTING Instead of generally passing NULL to NF_HOOK_COND() for input device, pass skb->dev which contains input device for routed skbs. Note that iptables (both legacy and nft) reject rules with input interface match from being added to POSTROUTING chains, but nftables allows this. Cc: Eric Garver <eric@garver.life> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>