Re: [PATCH nf] netfilter: nf_tables: don't use position attribute on rule replacement

2018-11-12 Thread Pablo Neira Ayuso
On Sun, Nov 04, 2018 at 12:07:14PM +0100, Florian Westphal wrote: > Its possible to set both HANDLE and POSITION when replacing a rule. > In this case, the rule at POSITION gets replaced using the > userspace-provided handle. Rule handles are supposed to be generated > by the kernel only. > >

[PATCH nf] netfilter: nf_tables: don't use position attribute on rule replacement

2018-11-04 Thread Florian Westphal
Its possible to set both HANDLE and POSITION when replacing a rule. In this case, the rule at POSITION gets replaced using the userspace-provided handle. Rule handles are supposed to be generated by the kernel only. Duplicate handles should be harmless, however better disable this "feature" by