netfilter: xt_socket: make module available for INPUT chain

This should make it possible to test for the existence of local
sockets in the INPUT path.

References: http://marc.info/?l=netfilter-devel&m=125380481517129&w=2

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Balazs Scheidler <bazsi@balabit.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>

1 files changed, 4 insertions, 2 deletions

diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index 362afbd60a96..6a902564d24f 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -192,7 +192,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                 .revision       = 0,
                 .family         = NFPROTO_IPV4,
                 .match          = socket_mt_v0,
-                .hooks          = 1 << NF_INET_PRE_ROUTING,
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
         {
@@ -201,7 +202,8 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
                 .family         = NFPROTO_IPV4,
                 .match          = socket_mt_v1,
                 .matchsize      = sizeof(struct xt_socket_mtinfo1),
-                .hooks          = 1 << NF_INET_PRE_ROUTING,
+                .hooks          = (1 << NF_INET_PRE_ROUTING) |
+                                  (1 << NF_INET_LOCAL_IN),
                 .me             = THIS_MODULE,
         },
 };