netfilter: nf_tables: validate chain type update if available

Browse source

[ Upstream commit aaba7ddc85 ]

Parse netlink attribute containing the chain type in this update, to
bail out if this is different from the existing type.

Otherwise, it is possible to define a chain with the same name, hook and
priority but different type, which is silently ignored.

Fixes: 96518518cc ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Pablo Neira Ayuso 2023-12-14 22:43:22 +01:00 • committed by Greg Kroah-Hartman

parent 66f0f06ffb

commit ca3cbb2460

1 changed files with 10 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

net/netfilter/nf_tables_api.c

View file