netfilter: nf_tables_bridge: update hook_mask to allow {pre,post}routing

Fixes: 36d2af5 ("netfilter: nf_tables: allow to filter from prerouting and postrouting")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/bridge/netfilter/nf_tables_bridge.c b/net/bridge/netfilter/nf_tables_bridge.c
index da17a5eab8b40e5df3eeafcef74934534eb26dd1..074c557ab505eb75bd0970a3045a78f0ca5c85dd 100644 (file)
--- a/net/bridge/netfilter/nf_tables_bridge.c
+++ b/net/bridge/netfilter/nf_tables_bridge.c
@@ -75,9 +75,11 @@ static const struct nf_chain_type filter_bridge = {
        .type           = NFT_CHAIN_T_DEFAULT,
        .family         = NFPROTO_BRIDGE,
        .owner          = THIS_MODULE,
-       .hook_mask      = (1 << NF_BR_LOCAL_IN) |
+       .hook_mask      = (1 << NF_BR_PRE_ROUTING) |
+                         (1 << NF_BR_LOCAL_IN) |
                          (1 << NF_BR_FORWARD) |
-                         (1 << NF_BR_LOCAL_OUT),
+                         (1 << NF_BR_LOCAL_OUT) |
+                         (1 << NF_BR_POST_ROUTING),
 };
 
 static int __init nf_tables_bridge_init(void)