netfilter: x_tables: add context to know if extension runs from nft_compat

[karo-tx-linux.git] / net / ipv4 / netfilter / ipt_CLUSTERIP.c

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 771ab3d01ad3dc303ac999e539a9c8ab5845baf2..45cb16a6a4a337c564d880485c45ca46229cb152 100644 (file)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -367,6 +367,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
        struct clusterip_config *config;
        int ret;
 
+       if (par->nft_compat) {
+               pr_err("cannot use CLUSTERIP target from nftables compat\n");
+               return -EOPNOTSUPP;
+       }
+
        if (cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP &&
            cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT &&
            cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT_DPT) {