diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-10-16 14:25:05 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-10-23 13:01:24 +0200 |
| commit | b75a3e8371bce7985d3d149ad3442bf2a036065c (patch) | |
| tree | 92cdc18235c05c654de07795715f0aa14529f008 /net/netfilter/nf_tables_api.c | |
| parent | 3f0465a9ef02624e0a36db9e7c9bedcafcd6f6fe (diff) | |
netfilter: nf_tables: allow netdevice to be used only once per flowtable
Allow netdevice only once per flowtable, otherwise hit EEXIST.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_tables_api.c')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d6224c7b0e28..2664bc388db4 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1538,6 +1538,19 @@ err_hook_alloc: return ERR_PTR(err); } +static bool nft_hook_list_find(struct list_head *hook_list, + const struct nft_hook *this) +{ + struct nft_hook *hook; + + list_for_each_entry(hook, hook_list, list) { + if (this->ops.dev == hook->ops.dev) + return true; + } + + return false; +} + static int nf_tables_parse_netdev_hooks(struct net *net, const struct nlattr *attr, struct list_head *hook_list) @@ -1557,6 +1570,10 @@ static int nf_tables_parse_netdev_hooks(struct net *net, err = PTR_ERR(hook); goto err_hook; } + if (nft_hook_list_find(hook_list, hook)) { + err = -EEXIST; + goto err_hook; + } list_add_tail(&hook->list, hook_list); n++; |