Re: [PATCH net-next,v2 2/2] net: sched: add em_ipt ematch for calling xtables matches

[Pablo Neira Ayuso]

On Fri, Jan 26, 2018 at 06:48:53PM +0200, Eyal Birger wrote:
> diff --git a/net/sched/em_ipt.c b/net/sched/em_ipt.c
> new file mode 100644
> index 0000000..2103b30
> --- /dev/null
> +++ b/net/sched/em_ipt.c
[...]
> +static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em,
> +                     struct tcf_pkt_info *info)
> +{
> +     const struct em_ipt_match *im = (const void *)em->data;
> +     struct xt_action_param acpar = {};
> +     struct net_device *indev = NULL;
> +     struct nf_hook_state state;
> +     int ret;
> +
> +     if (unlikely(!skb_at_tc_ingress(skb))) {
> +             pr_notice_once("ipt match must not be used at egress\n");

Isn't there a way to reject the use of this from ->change()? ie. from
control plane configuration.

> +             return 0;
> +     }