Skip to content

Commit

Permalink
netfilter: nf_tables: allow to change chain policy without hook if it…
Browse files Browse the repository at this point in the history
… exists

If there's an existing base chain, we have to allow to change the
default policy without indicating the hook information.

However, if the chain doesn't exists, we have to enforce the presence of
the hook attribute.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  • Loading branch information
Pablo Neira Ayuso committed Mar 17, 2015
1 parent d8bdff5 commit d6b6cb1
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion net/netfilter/nf_tables_api.c
Original file line number Diff line number Diff line change
Expand Up @@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,

if (nla[NFTA_CHAIN_POLICY]) {
if ((chain != NULL &&
!(chain->flags & NFT_BASE_CHAIN)) ||
!(chain->flags & NFT_BASE_CHAIN)))
return -EOPNOTSUPP;

if (chain == NULL &&
nla[NFTA_CHAIN_HOOK] == NULL)
return -EOPNOTSUPP;

Expand Down

0 comments on commit d6b6cb1

Please sign in to comment.