netfilter: nf_tables: Fix for deleting base chains with payload
authorPhil Sutter <phil@nwl.cc>
Fri, 16 Jun 2023 15:56:11 +0000 (17:56 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Tue, 20 Jun 2023 20:43:42 +0000 (22:43 +0200)
commit42e344f01688490cdac4bed8f5ba21817cad26ee
tree46f18ae549d01e1da76f421367c8376e8f7f96d5
parent62f9a68a36d4441a6c412b81faed102594bc6670
netfilter: nf_tables: Fix for deleting base chains with payload

When deleting a base chain, iptables-nft simply submits the whole chain
to the kernel, including the NFTA_CHAIN_HOOK attribute. The new code
added by fixed commit then turned this into a chain update, destroying
the hook but not the chain itself. Detect the situation by checking if
the chain type is either netdev or inet/ingress.

Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c