tree 9a488cb70c3b6e802829b4cf6060aad86850c47b
parent 523b929d5446c023e1219aa81455a8c766cac883
author Pablo Neira Ayuso <pablo@netfilter.org> 1414415297 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1414756209 +0100

netfilter: nft_reject_bridge: restrict reject to prerouting and input

Restrict the reject expression to the prerouting and input bridge
hooks. If we allow this to be used from forward or any other later
bridge hook, if the frame is flooded to several ports, we'll end up
sending several reject packets, one per cloned packet.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>