Commit a6e57c4a authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nfnetlink_hook: missing chain family 



The family is relevant for pseudo-families like NFPROTO_INET
otherwise the user needs to rely on the hook function name to
differentiate it from NFPROTO_IPV4 and NFPROTO_IPV6 names.

Add nfnl_hook_chain_desc_attributes instead of using the existing
NFTA_CHAIN_* attributes, since these do not provide a family number.

Fixes: e2cf17d3 ("netfilter: add new hook nfnl subsystem")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 61e0c2bc

include/uapi/linux/netfilter/nfnetlink_hook.h

+9 −0
Original line number Diff line number Diff line
@@ -43,6 +43,15 @@ enum nfnl_hook_chain_info_attributes { 
};

#define NFNLA_HOOK_INFO_MAX (__NFNLA_HOOK_INFO_MAX - 1)



enum nfnl_hook_chain_desc_attributes {

	NFNLA_CHAIN_UNSPEC,

	NFNLA_CHAIN_TABLE,

	NFNLA_CHAIN_FAMILY,

	NFNLA_CHAIN_NAME,

	__NFNLA_CHAIN_MAX,

};

#define NFNLA_CHAIN_MAX (__NFNLA_CHAIN_MAX - 1)



/**

 * enum nfnl_hook_chaintype - chain type

 *

net/netfilter/nfnetlink_hook.c

+6 −2
Original line number Diff line number Diff line
@@ -89,11 +89,15 @@ static int nfnl_hook_put_nft_chain_info(struct sk_buff *nlskb, 
	if (!nest2)

		goto cancel_nest;



	ret = nla_put_string(nlskb, NFTA_CHAIN_TABLE, chain->table->name);

	ret = nla_put_string(nlskb, NFNLA_CHAIN_TABLE, chain->table->name);

	if (ret)

		goto cancel_nest;



	ret = nla_put_string(nlskb, NFTA_CHAIN_NAME, chain->name);

	ret = nla_put_string(nlskb, NFNLA_CHAIN_NAME, chain->name);

	if (ret)

		goto cancel_nest;



	ret = nla_put_u8(nlskb, NFNLA_CHAIN_FAMILY, chain->table->family);

	if (ret)

		goto cancel_nest;