On Fri, Jan 26, 2018 at 06:48:53PM +0200, Eyal Birger wrote: > diff --git a/net/sched/em_ipt.c b/net/sched/em_ipt.c > new file mode 100644 > index 0000000..2103b30 > --- /dev/null > +++ b/net/sched/em_ipt.c [...] > +static int em_ipt_match(struct sk_buff *skb, struct tcf_ematch *em, > + struct tcf_pkt_info *info) > +{ > + const struct em_ipt_match *im = (const void *)em->data; > + struct xt_action_param acpar = {}; > + struct net_device *indev = NULL; > + struct nf_hook_state state; > + int ret; > + > + if (unlikely(!skb_at_tc_ingress(skb))) { > + pr_notice_once("ipt match must not be used at egress\n");
Isn't there a way to reject the use of this from ->change()? ie. from control plane configuration. > + return 0; > + }