| Message ID | 20240328031855.2063-2-pablo@netfilter.org |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [net,1/4] netfilter: nf_tables: reject destroy command to remove basechain hooks | expand |
Hello: This series was applied to netdev/net.git (main) by Pablo Neira Ayuso <pablo@netfilter.org>: On Thu, 28 Mar 2024 04:18:52 +0100 you wrote: > Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an > existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed. > > Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> > --- > net/netfilter/nf_tables_api.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Here is the summary with links: - [net,1/4] netfilter: nf_tables: reject destroy command to remove basechain hooks https://git.kernel.org/netdev/net/c/b32ca27fa238 - [net,2/4] netfilter: nf_tables: reject table flag and netdev basechain updates https://git.kernel.org/netdev/net/c/1e1fb6f00f52 - [net,3/4] netfilter: nf_tables: skip netdev hook unregistration if table is dormant https://git.kernel.org/netdev/net/c/216e7bf7402c - [net,4/4] netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c https://git.kernel.org/netdev/net/c/15fba562f7a9 You are awesome, thank you!
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 5fa3d3540c93..a1a8030e16a5 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2944,7 +2944,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); if (nla[NFTA_CHAIN_HOOK]) { - if (chain->flags & NFT_CHAIN_HW_OFFLOAD) + if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN || + chain->flags & NFT_CHAIN_HW_OFFLOAD) return -EOPNOTSUPP; if (nft_is_base_chain(chain)) {
Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed. Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)