diff mbox

[nf] netfilter: nf_tables: allow to change chain policy without hook if it exists

Message ID 1426596341-3533-1-git-send-email-pablo@netfilter.org
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Pablo Neira Ayuso March 17, 2015, 12:45 p.m. UTC 
If there's an existing base chain, we have to allow changing the default
policy without indicating the hook information.

However, if the chain exists, we have to enforce the presence of the
hook attribute.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
This allows this syntax:

 nft add chain filter input { policy drop\; }

for an existing input base chain.

 net/netfilter/nf_tables_api.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox

Patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ab7779..ac1a952 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1225,7 +1225,10 @@  static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 
 	if (nla[NFTA_CHAIN_POLICY]) {
 		if ((chain != NULL &&
-		    !(chain->flags & NFT_BASE_CHAIN)) ||
+		    !(chain->flags & NFT_BASE_CHAIN)))
+			return -EOPNOTSUPP;
+
+		if (chain == NULL &&
 		    nla[NFTA_CHAIN_HOOK] == NULL)
 			return -EOPNOTSUPP;