diff options
| author | Pablo Neira Ayuso | 2017-09-03 23:56:00 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2017-09-04 17:34:55 +0200 |
| commit | a8278400809dd99eb24468c02c8d4f0cb0003eae (patch) | |
| tree | ced0c8a3e75d521826c450d66e652f6e7fa9c601 /net | |
| parent | 2335ba704f32b855651d0cd15dd9b271ec565fb6 (diff) | |
netfilter: nf_tables: use NLM_F_NONREC for deletion requests
Bail out if user requests non-recursive deletion for tables and sets.
This new flags tells nf_tables netlink interface to reject deletions if
tables and sets have content.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d95dfafea1e7..47fc7cd3f936 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -860,6 +860,10 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk, if (IS_ERR(table)) return PTR_ERR(table); + if (nlh->nlmsg_flags & NLM_F_NONREC && + table->use > 0) + return -EBUSY; + ctx.afi = afi; ctx.table = table; @@ -3225,7 +3229,9 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk, set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask); if (IS_ERR(set)) return PTR_ERR(set); - if (!list_empty(&set->bindings)) + + if (!list_empty(&set->bindings) || + (nlh->nlmsg_flags & NLM_F_NONREC && atomic_read(&set->nelems) > 0)) return -EBUSY; return nft_delset(&ctx, set); |