Unverified Commit 2a66dad6 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2384 netfilter: nf_tables: disallow rule removal from chain binding 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ziyang Xuan <william.xuanziyang@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/6B2D3EWWMO3XVBJMAJ6I7LZQ4WJTHUU4/ 
 
https://gitee.com/src-openeuler/kernel/issues/I84NFY 
 
Link:https://gitee.com/openeuler/kernel/pulls/2384

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents e427a81b 2f81814d

net/netfilter/nf_tables_api.c

+15 −4
Original line number Diff line number Diff line
@@ -1250,7 +1250,7 @@ static int nft_flush_table(struct nft_ctx *ctx) 
		if (!nft_is_active_next(ctx->net, chain))

			continue;



		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx->chain = chain;
@@ -1295,7 +1295,7 @@ static int nft_flush_table(struct nft_ctx *ctx) 
		if (!nft_is_active_next(ctx->net, chain))

			continue;



		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			continue;



		ctx->chain = chain;
@@ -2579,6 +2579,9 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk, 
		return PTR_ERR(chain);

	}



	if (nft_chain_binding(chain))

		return -EOPNOTSUPP;



	if (nlh->nlmsg_flags & NLM_F_NONREC &&

	    chain->use > 0)

		return -EBUSY;
@@ -3474,6 +3477,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, 
	}



	if (nlh->nlmsg_flags & NLM_F_REPLACE) {

		if (nft_chain_binding(chain)) {

			err = -EOPNOTSUPP;

			goto err2;

		}



		trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);

		if (trans == NULL) {

			err = -ENOMEM;
@@ -3580,7 +3588,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, 
			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);

			return PTR_ERR(chain);

		}

		if (nft_chain_is_bound(chain))

		if (nft_chain_binding(chain))

			return -EOPNOTSUPP;

	}
@@ -3610,7 +3618,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, 
		list_for_each_entry(chain, &table->chains, list) {

			if (!nft_is_active_next(net, chain))

				continue;

			if (nft_chain_is_bound(chain))

			if (nft_chain_binding(chain))

				continue;



			ctx.chain = chain;
@@ -9194,6 +9202,9 @@ static void __nft_release_table(struct net *net, struct nft_table *table) 
	ctx.family = table->family;

	ctx.table = table;

	list_for_each_entry(chain, &table->chains, list) {

		if (nft_chain_binding(chain))

			continue;



		ctx.chain = chain;

		list_for_each_entry_safe(rule, nr, &chain->rules, list) {

			list_del(&rule->list);