• Pablo Neira Ayuso's avatar
    netfilter: nf_tables: reject hook configuration updates on existing chains · 6133740d
    Pablo Neira Ayuso authored
    Currently, if you add a base chain whose name clashes with an existing
    non-base chain, nf_tables doesn't complain about this. Similarly, if you
    update the chain type, the hook number and priority.
    
    With this patch, nf_tables bails out in case any of this unsupported
    operations occur by returning EBUSY.
    
     # nft add table x
     # nft add chain x y
     # nft add chain x y { type nat hook input priority 0\; }
     <cmdline>:1:1-49: Error: Could not process rule: Device or resource busy
     add chain x y { type nat hook input priority 0; }
     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    6133740d
nf_tables_api.c 116 KB