netfilter: nf_tables: reject nat hook registration if prio is before conntrack

No problem for iptables as priorities are fixed values defined in the
nat modules, but in nftables the priority its coming from userspace.

Reject in case we see that such a hook would not work.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 838eb581b5ab122950aaca51e74744b6f06b7700..36d38f8b02845194b6db44bc8fde3660a21cdbef 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1264,7 +1264,7 @@ static void nf_tables_chain_destroy(struct nft_chain *chain)
 
 struct nft_chain_hook {
        u32                             num;
-       u32                             priority;
+       s32                             priority;
        const struct nf_chain_type      *type;
        struct net_device               *dev;
 };
@@ -1303,6 +1303,11 @@ static int nft_chain_parse_hook(struct net *net,
        }
        if (!(type->hook_mask & (1 << hook->num)))
                return -EOPNOTSUPP;
+
+       if (type->type == NFT_CHAIN_T_NAT &&
+           hook->priority <= NF_IP_PRI_CONNTRACK)
+               return -EOPNOTSUPP;
+
        if (!try_module_get(type->owner))
                return -ENOENT;