From b75a3e8371bce7985d3d149ad3442bf2a036065c Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 16 Oct 2019 14:25:05 +0200 Subject: netfilter: nf_tables: allow netdevice to be used only once per flowtable Allow netdevice only once per flowtable, otherwise hit EEXIST. Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_tables_api.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'net/netfilter') diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d6224c7b0e28..2664bc388db4 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1538,6 +1538,19 @@ err_hook_alloc: return ERR_PTR(err); } +static bool nft_hook_list_find(struct list_head *hook_list, + const struct nft_hook *this) +{ + struct nft_hook *hook; + + list_for_each_entry(hook, hook_list, list) { + if (this->ops.dev == hook->ops.dev) + return true; + } + + return false; +} + static int nf_tables_parse_netdev_hooks(struct net *net, const struct nlattr *attr, struct list_head *hook_list) @@ -1557,6 +1570,10 @@ static int nf_tables_parse_netdev_hooks(struct net *net, err = PTR_ERR(hook); goto err_hook; } + if (nft_hook_list_find(hook_list, hook)) { + err = -EEXIST; + goto err_hook; + } list_add_tail(&hook->list, hook_list); n++; -- cgit v1.2.3