netfilter: nft_meta: fix cgroup matching

Browse source

We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.

Fixes: ce67417 ("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2015-03-27 12:14:13 +01:00

parent afb7718016

commit c5035c77f8

1 changed files with 2 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

net/netfilter/nft_meta.c

View file