netfilter: xt_physdev: Fix spurious error message in physdev_mt_check
Simplify the check in physdev_mt_check() to emit an error message only when passed an invalid chain (ie, NF_INET_LOCAL_OUT). This avoids cluttering up the log with errors against valid rules. For large/heavily modified rulesets, current behavior can quickly overwhelm the ring buffer, because this function gets called on every change, regardless of the rule that was changed. Signed-off-by: Todd Seidelmann <tseidelmann@linode.com> Acked-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
f53a7ad189
commit
3cf2f450ff
|
@ -101,11 +101,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
|
||||||
if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
|
if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
|
||||||
(!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
|
(!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
|
||||||
info->invert & XT_PHYSDEV_OP_BRIDGED) &&
|
info->invert & XT_PHYSDEV_OP_BRIDGED) &&
|
||||||
par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
|
par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
|
||||||
(1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
|
|
||||||
pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
|
pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
|
||||||
if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
|
return -EINVAL;
|
||||||
return -EINVAL;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!brnf_probed) {
|
if (!brnf_probed) {
|
||||||
|
|
Loading…
Reference in New Issue