netfilter: xt_socket: make module available for INPUT chain

This should make it possible to test for the existence of local
sockets in the INPUT path.

References: http://marc.info/?l=netfilter-devel&m=125380481517129&w=2

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 362afbd60a9691c29ccea9c3a3c0f4c7adb9f237..6a902564d24f7e44233bc51cd8933d9971d0f4ad 100644 (file)
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -192,7 +192,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                .revision       = 0,
                .family         = NFPROTO_IPV4,
                .match          = socket_mt_v0,
-               .hooks          = 1 << NF_INET_PRE_ROUTING,
+               .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                 (1 << NF_INET_LOCAL_IN),
                .me             = THIS_MODULE,
        },
        {
@@ -201,7 +202,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                .family         = NFPROTO_IPV4,
                .match          = socket_mt_v1,
                .matchsize      = sizeof(struct xt_socket_mtinfo1),
-               .hooks          = 1 << NF_INET_PRE_ROUTING,
+               .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                 (1 << NF_INET_LOCAL_IN),
                .me             = THIS_MODULE,
        },
 };