From a66b5ad9540dd64c7c67006201b8b3ccf8e4316b Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 19 Apr 2023 11:50:01 +0200 Subject: src: allow for updating devices on existing netdev chain This patch allows you to add/remove devices to an existing chain: # cat ruleset.nft table netdev x { chain y { type filter hook ingress devices = { eth0 } priority 0; policy accept; } } # nft -f ruleset.nft # nft add chain netdev x y '{ devices = { eth1 }; }' # nft list ruleset table netdev x { chain y { type filter hook ingress devices = { eth0, eth1 } priority 0; policy accept; } } # nft delete chain netdev x y '{ devices = { eth0 }; }' # nft list ruleset table netdev x { chain y { type filter hook ingress devices = { eth1 } priority 0; policy accept; } } This feature allows for creating an empty netdev chain, with no devices. In such case, no packets are seen until a device is registered. This patch includes extended netlink error reporting: # nft add chain netdev x y '{ devices = { x } ; }' Error: Could not process rule: No such file or directory add chain netdev x y { devices = { x } ; } ^ Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/chains/dumps/netdev_chain_0.nft | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 tests/shell/testcases/chains/dumps/netdev_chain_0.nft (limited to 'tests/shell/testcases/chains/dumps/netdev_chain_0.nft') diff --git a/tests/shell/testcases/chains/dumps/netdev_chain_0.nft b/tests/shell/testcases/chains/dumps/netdev_chain_0.nft new file mode 100644 index 00000000..bc02dc18 --- /dev/null +++ b/tests/shell/testcases/chains/dumps/netdev_chain_0.nft @@ -0,0 +1,5 @@ +table netdev x { + chain y { + type filter hook ingress devices = { d0, d1 } priority filter; policy accept; + } +} -- cgit v1.2.3