netfilter: nf_tables: allow to change chain policy without hook if it exists

If there's an existing base chain, we have to allow changing the default policy without indicating the hook information.

However, if the chain exists, we have to enforce the presence of the hook attribute.

---
This allows this syntax:

nft add chain filter input { policy drop\; }

for an existing input base chain.

 net/netfilter/nf_tables_api.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 6ab7779..ac1a952 100644
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 
 	if (nla[NFTA_CHAIN_POLICY]) {
 		if ((chain != NULL &&
-		    !(chain->flags & NFT_BASE_CHAIN)) ||
+		    !(chain->flags & NFT_BASE_CHAIN)))
+			return -EOPNOTSUPP;
+
+		if (chain == NULL &&
 		    nla[NFTA_CHAIN_HOOK] == NULL)
 			return -EOPNOTSUPP;
 

1.7.10.4