| commit | c5035c77f89364d2da2871d829553bd1a4321940 | [log] [tgz] |
|---|---|---|
| author | Pablo Neira Ayuso <pablo@netfilter.org> | Fri Mar 27 12:14:13 2015 +0100 |
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | Wed Apr 01 11:33:00 2015 +0200 |
| tree | d403a5f3f17acf2b1e0dc7946937dc008026072d | |
| parent | afb7718016fcb0370ac29a83b2839c78b76c2960 [diff] |
netfilter: nft_meta: fix cgroup matching
We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.
Fixes: ce67417 ("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>