From 8e1522698a7495002e5154f5643abb68e9c3a89a Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Tue, 21 Jul 2015 15:45:41 +0200 Subject: iptables-compat: Allow to insert into rule_count+1 position iptables allows to insert a rule into the next non existing rule number but iptables-compat does not allow to do this Signed-off-by: Thomas Woerner Signed-off-by: Pablo Neira Ayuso --- iptables/nft.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/iptables/nft.c b/iptables/nft.c index 7cd56efa..fb6ef919 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -1854,6 +1854,17 @@ int nft_rule_insert(struct nft_handle *h, const char *chain, r = nft_rule_find(h, list, chain, table, data, rulenum); if (r == NULL) { + /* special case: iptables allows to insert into + * rule_count + 1 position. + */ + r = nft_rule_find(h, list, chain, table, data, + rulenum - 1); + if (r != NULL) { + nft_rule_list_destroy(list); + return nft_rule_append(h, chain, table, data, + 0, verbose); + } + errno = ENOENT; goto err; } -- cgit v1.2.3