Commit 84ba7dd7 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: reject nat hook registration if prio is before conntrack 



No problem for iptables as priorities are fixed values defined in the
nat modules, but in nftables the priority its coming from userspace.

Reject in case we see that such a hook would not work.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent f92b40a8

net/netfilter/nf_tables_api.c

+6 −1
Original line number Diff line number Diff line
@@ -1264,7 +1264,7 @@ static void nf_tables_chain_destroy(struct nft_chain *chain) 


struct nft_chain_hook {

	u32				num;

	u32				priority;

	s32				priority;

	const struct nf_chain_type	*type;

	struct net_device		*dev;

};
@@ -1303,6 +1303,11 @@ static int nft_chain_parse_hook(struct net *net, 
	}

	if (!(type->hook_mask & (1 << hook->num)))

		return -EOPNOTSUPP;



	if (type->type == NFT_CHAIN_T_NAT &&

	    hook->priority <= NF_IP_PRI_CONNTRACK)

		return -EOPNOTSUPP;



	if (!try_module_get(type->owner))

		return -ENOENT;

CRA Git | Maintained and supported by SUSTech CRA and CCSE