diff --git a/net/netfilter/xt_pkttype.c b/net/netfilter/xt_pkttype.c index 5b645cb..4c0b0e1 100644 --- a/net/netfilter/xt_pkttype.c +++ b/net/netfilter/xt_pkttype.c @@ -42,13 +42,29 @@ pkttype_mt(const struct sk_buff *skb, struct xt_action_param *par) return (type == info->pkttype) ^ info->invert; } +static int pkttype_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_pkttype_info *info = par->matchinfo; + +#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) + if (par->family == NFPROTO_IPV6) { + if (info->pkttype == PACKET_BROADCAST) { + pr_err("IPv6 does not support BROADCAST packets\n"); + return -EINVAL; + } + } +#endif + return 0; +} + static struct xt_match pkttype_mt_reg __read_mostly = { - .name = "pkttype", - .revision = 0, - .family = NFPROTO_UNSPEC, - .match = pkttype_mt, - .matchsize = sizeof(struct xt_pkttype_info), - .me = THIS_MODULE, + .name = "pkttype", + .revision = 0, + .family = NFPROTO_UNSPEC, + .checkentry = pkttype_mt_checkentry, + .match = pkttype_mt, + .matchsize = sizeof(struct xt_pkttype_info), + .me = THIS_MODULE, }; static int __init pkttype_mt_init(void)