diff mbox

[10/11] netfilter: nf_tables: return error for NLM_F_REPLACE without rule handle

Message ID 1355338061-5517-11-git-send-email-kaber@trash.net
State Accepted
Headers show

Commit Message

Patrick McHardy Dec. 12, 2012, 6:47 p.m. UTC 
From: Patrick McHardy <kaber@trash.net>

Return an error when NLM_F_REPLACE is given without the handle of the
rule to replace.

Signed-off-by: Patrick McHardy <kaber@trash.net>
---
 net/netfilter/nf_tables_api.c | 10 +++-------
 1 Datei geändert, 3 Zeilen hinzugefügt(+), 7 Zeilen entfernt(-)
diff mbox

Patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c91f638..bbd463e 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1368,13 +1368,12 @@  static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
 		if (nlh->nlmsg_flags & NLM_F_EXCL)
 			return -EEXIST;
-		if (nlh->nlmsg_flags & NLM_F_REPLACE) {
+		if (nlh->nlmsg_flags & NLM_F_REPLACE)
 			old_rule = rule;
-			rule = NULL;
-		} else
+		else
 			return -EOPNOTSUPP;
 	} else {
-		if (!create)
+		if (!create || nlh->nlmsg_flags & NLM_F_REPLACE)
 			return -EINVAL;
 		handle = nf_tables_alloc_handle(table);
 	}
@@ -1415,9 +1414,6 @@  static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 	}
 
 	if (nlh->nlmsg_flags & NLM_F_REPLACE) {
-		if (old_rule == NULL)
-			goto err2;
-
 		list_replace_rcu(&old_rule->list, &rule->list);
 
 		nf_tables_rule_notify(skb, nlh, table, chain, old_rule,