diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-07-11 22:06:44 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-07-12 16:17:16 +0200 |
| commit | 4e95200ded923f0eb5579c33b91176193c59dbe0 (patch) | |
| tree | 8b83c9ab49e2b1840c1818e68b08a1a1f220e283 /iptables/nft-bridge.c | |
| parent | 82ccfb488eeac5507471099b9b4e6d136cc06e3b (diff) | |
nft-bridge: pass context structure to ops->add() to improve anonymous set support
Add context structure to improve bridge among support which creates an
anonymous set. This context structure specifies the command and it
allows to optionally store a anonymous set.
Use this context to generate native bytecode only if this is an
add/insert/replace command.
This fixes a dangling anonymous set that is created on rule removal.
Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
Reported-and-tested-by: Igor Raits <igor@gooddata.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables/nft-bridge.c')
| -rw-r--r-- | iptables/nft-bridge.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c index 6e509507..391a8ab7 100644 --- a/iptables/nft-bridge.c +++ b/iptables/nft-bridge.c @@ -138,7 +138,8 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) static int nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, - struct nftnl_rule *r, struct xt_entry_match *m) + struct nft_rule_ctx *ctx, struct nftnl_rule *r, + struct xt_entry_match *m) { if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) xtables_error(PARAMETER_PROBLEM, @@ -152,10 +153,10 @@ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, xtables_error(PARAMETER_PROBLEM, "For IPv6 filtering the protocol must be specified as IPv6."); - return add_match(h, r, m); + return add_match(h, ctx, r, m); } -static int nft_bridge_add(struct nft_handle *h, +static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, struct nftnl_rule *r, struct iptables_command_state *cs) { @@ -217,7 +218,7 @@ static int nft_bridge_add(struct nft_handle *h, for (iter = cs->match_list; iter; iter = iter->next) { if (iter->ismatch) { - if (nft_bridge_add_match(h, fw, r, iter->u.match->m)) + if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m)) break; } else { if (add_target(r, iter->u.watcher->t)) |