* [PATCH nf] netfilter: nf_tables: allow to change chain policy without hook if it exists
@ 2015-03-17 12:45 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2015-03-17 12:45 UTC (permalink / raw)
To: netfilter-devel; +Cc: kaber
If there's an existing base chain, we have to allow changing the default
policy without indicating the hook information.
However, if the chain exists, we have to enforce the presence of the
hook attribute.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
This allows this syntax:
nft add chain filter input { policy drop\; }
for an existing input base chain.
net/netfilter/nf_tables_api.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ab7779..ac1a952 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
if (nla[NFTA_CHAIN_POLICY]) {
if ((chain != NULL &&
- !(chain->flags & NFT_BASE_CHAIN)) ||
+ !(chain->flags & NFT_BASE_CHAIN)))
+ return -EOPNOTSUPP;
+
+ if (chain == NULL &&
nla[NFTA_CHAIN_HOOK] == NULL)
return -EOPNOTSUPP;
--
1.7.10.4
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-03-17 12:42 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-03-17 12:45 [PATCH nf] netfilter: nf_tables: allow to change chain policy without hook if it exists Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).