path: root/iptables/nft.h
diff options
authorPhil Sutter <>2018-11-27 20:07:11 +0100
committerPablo Neira Ayuso <>2018-11-27 20:46:26 +0100
commitccf154d7420c07b6e6febc1c3b8b31d2bd1adbe6 (patch)
treef197af81ce1b071b2a34e8f563a02aec3f6daa00 /iptables/nft.h
parent2ed6c85f8743a83d2b302bf6bd8d16b5efa3bb14 (diff)
xtables: Don't use native nftables comments
The problem with converting libxt_comment into nftables comment is that rules change when parsing from kernel due to comment match being moved to the end of the match list. And since match ordering matters, the rule may not be found anymore when checking or deleting. Apart from that, iptables-nft didn't support multiple comments per rule anymore. This is a compatibility issue without technical reason. Leave conversion from nftables comment to libxt_comment in place so we don't break running systems during an update. Signed-off-by: Phil Sutter <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'iptables/nft.h')
1 files changed, 0 insertions, 1 deletions
diff --git a/iptables/nft.h b/iptables/nft.h
index 71119994..bf60ab39 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -121,7 +121,6 @@ int add_match(struct nftnl_rule *r, struct xt_entry_match *m);
int add_target(struct nftnl_rule *r, struct xt_entry_target *t);
int add_jumpto(struct nftnl_rule *r, const char *name, int verdict);
int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set);
-int add_comment(struct nftnl_rule *r, const char *comment);
char *get_comment(const void *data, uint32_t data_len);
enum nft_rule_print {