summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2015-03-17 13:21:42 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2015-03-17 13:48:04 +0100
commitd6b6cb1d3e6f78d55c2d4043d77d0d8def3f3b99 (patch)
tree62e6cdaa684559273f0f7e9d46e29fc57476084a
parentd8bdff59cea141d2e5f7e98c1b11d3e0271640bd (diff)
downloadop-kernel-dev-d6b6cb1d3e6f78d55c2d4043d77d0d8def3f3b99.zip
op-kernel-dev-d6b6cb1d3e6f78d55c2d4043d77d0d8def3f3b99.tar.gz
netfilter: nf_tables: allow to change chain policy without hook if it exists
If there's an existing base chain, we have to allow to change the default policy without indicating the hook information. However, if the chain doesn't exists, we have to enforce the presence of the hook attribute. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--net/netfilter/nf_tables_api.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ab7779..ac1a952 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
if (nla[NFTA_CHAIN_POLICY]) {
if ((chain != NULL &&
- !(chain->flags & NFT_BASE_CHAIN)) ||
+ !(chain->flags & NFT_BASE_CHAIN)))
+ return -EOPNOTSUPP;
+
+ if (chain == NULL &&
nla[NFTA_CHAIN_HOOK] == NULL)
return -EOPNOTSUPP;
OpenPOWER on IntegriCloud