summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* xtables: Move new chain check to where it belongsPhil Sutter2019-02-132-3/+5
| | | | | | | | Instead of checking chain existence in xtables.c, do it in nft_chain_user_add() and reuse predefined error message. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error message when zeroing a non-existent chainPhil Sutter2019-02-131-1/+3
| | | | | | | | | | | | | Previously, error message was a bit misleading: | # iptables-nft -Z noexist | iptables: Incompatible with this kernel. Set errno value so that the typical "No chain/target/match by that name." is printed instead. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Eliminate dead code in __nft_rule_listPhil Sutter2019-02-111-12/+1
| | | | | | | | | | | If passed a rulenum > 0, the function uses nftnl_rule_lookup_byindex() and returns early. Negative rulenum values are not supposed to happen, so the remaining code which iterates over the full list of rules does not need to respect rulenum anymore. Fixes: 039b048965210 ("nft: Make use of nftnl_rule_lookup_byindex()") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: Support user-defined chain policiesPhil Sutter2019-02-086-19/+265
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Legacy ebtables supports policies for user-defined chains - and what's worse, they default to ACCEPT unlike anywhere else. So lack of support for this braindead feature in ebtables-nft is actually a change of behaviour which very likely affects all ebtables users out there. The solution implemented here uses an implicit (and transparent) last rule in all user-defined ebtables-nft chains with policy other than RETURN. This rule is identified by an nft comment "XTABLES_EB_INTERNAL_POLICY_RULE" (since commit ccf154d7420c0 ("xtables: Don't use native nftables comments") nft comments are not used otherwise). To minimize interference with existing code, this policy rule is removed from chains during cache population and the policy is saved in NFTNL_CHAIN_POLICY attribute. When committing changes to the kernel, nft_commit() traverses through the list of chains and (re-)creates policy rules if required. In ebtables-nft-restore, table flushes are problematic. To avoid weird kernel error responses, introduce a custom 'table_flush' callback which removes any pending policy rule add/remove jobs prior to creating the NFT_COMPAT_TABLE_FLUSH one. I've hidden all this mess behind checks for h->family, so hopefully impact on {ip,ip6,arp}tables-nft should be negligible. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Introduce UDATA_TYPE_EBTABLES_POLICYPhil Sutter2019-02-081-0/+3
| | | | | | | | | This will be used later to identify ebtables user-defined chain policy rules. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Don't assume NFTNL_RULE_USERDATA holds a commentPhil Sutter2019-02-081-17/+22
| | | | | | | | | If this rule attribute is present but does not contain a comment, get_comment() returns NULL which is then fed into strncpy() causing a crash. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-save: Fix table not found error messagePhil Sutter2019-02-081-2/+3
| | | | | | | | | | First of all, this error message should not appear on stdout, otherwise it may end in dump files. Next, with completely empty ruleset, even valid table names cause errors. To avoid this, continue operation if the not found table is a builtin one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Explicitly pass target to command_jump()Phil Sutter2019-02-078-9/+9
| | | | | | | | | The use of global 'optarg' variable inside that function is a mess, but most importantly it limits its applicability to input parsers. Fix this by having it take the option argument as a parameter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "ebtables: use extrapositioned negation consistently"Phil Sutter2019-02-0517-70/+62
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5f508b76a0cebaf91965ffa678089222e2d47964. While attempts at unifying syntax between arp-, eb- and iptables-nft increase the opportunity for more code-sharing, they are problematic when it comes to compatibility. Accepting the old syntax on input helps, but due to the fact that neither arptables nor ebtables support --check command we must expect for users to test existence of a rule by comparing input with output. If that happens in a script, deviating from the old syntax in output has a high chance of breaking it. Therefore revert Florian's patch changing inversion character position in output and review the old code for consistency - the only thing changed on top of the actual revert is ebtables' own copy of print_iface() to make it adhere to the intrapositioned negation scheme used throughout ebtables. Added extension tests by the reverted commit have been kept. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for false-positive rule matchingPhil Sutter2019-02-057-72/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | When comparing two rules with non-standard targets, differences in targets' payloads wasn't respected. The cause is a rather hideous one: Unlike xtables_find_match(), xtables_find_target() did not care whether the found target was already in use or not, so the same target instance was assigned to both rules and therefore payload comparison happened over the same memory location. With legacy iptables it is not possible to reuse a target: The only case where two rules (i.e., iptables_command_state instances) could exist at the same time is when comparing rules, but that's handled using libiptc. The above change clashes with ebtables-nft's reuse of target objects: While input parsing still just assigns the object from xtables_targets list, rule conversion from nftnl to iptables_command_state allocates new data. To fix this, make ebtables-nft input parsing use the common command_jump() routine instead of its own simplified copy. In turn, this also eliminates the ebtables-nft-specific variants of parse_target(), though with a slight change of behaviour: Names of user-defined chains are no longer allowed to contain up to 31 but merely 28 characters. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for crash when comparing rules with standard targetPhil Sutter2019-02-013-5/+29
| | | | | | | | | | When parsing an nftnl_rule with a standard verdict, nft_rule_to_iptables_command_state() initialized cs->target but didn't care about cs->target->t. When later comparing that rule to another, compare_targets() crashed due to unconditional access to t's fields. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix arptables extension testsPhil Sutter2019-02-014-10/+10
| | | | | | | | | | | With changes to arptables-nft output, many of these tests fail because rules are not printed as expected anymore. Since most of the tests with explicitly defined output did so just because of added --h-length and --h-type options, adjust input a little more (typically reordering of arguments) to make output match input. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Set h-type/h-length masks by default, tooPhil Sutter2019-02-011-2/+6
| | | | | | | | | | These masks are not used in nftables backend, but mangle extension checks arhln_mask value to make sure --h-length was given (which is implicitly the case). Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Fix potential memleaks in nft_*_rule_find()Phil Sutter2019-02-013-14/+26
| | | | | | | | | These functions parse an nftnl_rule into a local instance of iptables_command_state which potentially allocates memory (for matches or target), so call ops->clear_cs() before returning to caller. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix rule listing with countersPhil Sutter2019-02-011-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a partial revert of commit 583b27eabcad6 ("ebtables-save: add -c option, using xtables-style counters") which broke ruleset listing with '--Lc' flag turned on: | # ebtables-nft -L --Lc | Bridge table: filter | | Bridge chain: INPUT, entries: 0, policy: ACCEPT | | Bridge chain: FORWARD, entries: 2, policy: ACCEPT | -j foo | , pcnt = 0 -- bcnt = 0-j ACCEPT | , pcnt = 0 -- bcnt = 0 | Bridge chain: OUTPUT, entries: 0, policy: ACCEPT | | Bridge chain: foo, entries: 1, policy: RETURN | -j ACCEPT | , pcnt = 0 -- bcnt = 0% (That percentage sign means no newline after last line of output and doesn't belong to ebtables-nft's output.) Problem was that nft_bridge_print_rule() printed the counters after nft_bridge_save_rule() had already printed the newline character. Note also that there is no need to remove FMT_EBT_SAVE bit from 'format' variable: It is set only by ebtables-nft-save which doesn't call nft_bridge_print_rule(). Fixes: 583b27eabcad6 ("ebtables-save: add -c option, using xtables-style counters") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Catch errors when zeroing rule rountersPhil Sutter2019-02-011-1/+3
| | | | | | | Covscan complained about call to batch_rule_add() not being checked. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Add arptables-nft verbose output testPhil Sutter2019-01-311-0/+64
| | | | | | | | With arptables-nft output being in a very good state now, add a test to ensure it stays that way. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Don't print default h-len/h-type valuesPhil Sutter2019-01-313-21/+21
| | | | | | | | | | | | | | Default values for --h-len and --h-type being printed for rules where user didn't provide them is unexpected and confusing. The drawback is the opposite: If user provided either of them with their default value, they are later omitted when listing rules. Though since unlike legacy arptables we can't distinguish between not specified and specified with default value, we can't fix both - so choose to optimize for the more likely case. Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft-save: Fix position of -j optionPhil Sutter2019-01-313-45/+58
| | | | | | | | | | | | | | | | | | Legacy arptables-save (just like arptables itself) prints verdict as first option, then matches and finally any target options. To achieve this without introducing double/trailing spaces everywhere, integrate target ('-j') option printing into nft_arp_print_rule_details() and make it print separating whitespace before each option. In nft_arp_save_rule(), replace the call to save_matches_and_target() by by a direct call to cs->target->save() since the former prints '-j' option itself. Since there are no match extensions in arptables, any other code from that function is not needed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Remove space between *cnt= and valuePhil Sutter2019-01-311-2/+2
| | | | | | | | When printing rule counters, call xtables_print_num() with FMT_NOTABLE bit set to avoid spaces between equal sign and value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix CLASSIFY target printingPhil Sutter2019-01-311-13/+46
| | | | | | | | | In legacy arptables, CLASSIFY target is not printed with fixed hex number lengths. Counter this by introducing a dedicated target definition for NFPROTO_ARP only having own print/save callbacks. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix MARK target parsing and printingPhil Sutter2019-01-312-1/+96
| | | | | | | | | | | | | Legacy arptables parses mark values in hex no matter if prefixed with '0x' or not. Sadly, this is not easily achievable with guided option parser. Hence fall back to the old 'parse' callback. The introduced target definition is valid only for revision 2, but that's consistent with legacy arptables. When printing, use --set-mark option instead of --set-xmark. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Fix listing rules without targetPhil Sutter2019-01-311-1/+1
| | | | | | | | Don't try to print cs.jumpto if it is an empty string, otherwise listing (and verbose output) contains '-j' flag without argument. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Speed up chain deletion in large rulesetsPhil Sutter2019-01-291-0/+2
| | | | | | | | | | Kernel prefers to identify chain by handle if it was given which causes manual traversal of the chain list. In contrast, chain lookup by name in kernel makes use of a hash table so is considerably faster. Force this code path by removing the cached chain's handle when removing it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for inserting rule at wrong positionPhil Sutter2019-01-284-10/+176
| | | | | | | | | | | | | | | | | | | iptables-restore allows to insert rules at a certain position which is problematic for iptables-nft to realize since rule position is not determined by number but handle of previous or following rule and in case the rules surrounding the new one are new as well, they don't have a handle to refer to yet. Fix this by making use of NFTNL_RULE_POSITION_ID attribute: When inserting before a rule which does not have a handle, refer to it using its NFTNL_RULE_ID value. If the latter doesn't exist either, assign a new one to it. The last used rule ID value is tracked in a new field of struct nft_handle which is incremented before each use. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: Add a manpage for nfbpf_compilePhil Sutter2019-01-184-2/+75
| | | | | | | | Content is rather sparse, but still better than no manpage at all. Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix position of replaced rules in cachePhil Sutter2019-01-185-22/+22
| | | | | | | | | | | When replacing a rule, the replacement was simply appended to the chain's rule list. Instead, insert it where the rule it replaces was. This also fixes for zero counters command to remove the old rule from cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Add new builtin chains to cache immediatelyPhil Sutter2019-01-181-21/+9
| | | | | | | | | | | | Newly created builtin chains missing from cache was the sole reason for the immediate calls to nft_commit(). With nft_chain_builtin_add() inserting the new chain into the table's chain list, this is not needed anymore. Just make sure batch_obj_del() doesn't free the payload of NFT_COMPAT_CHAIN_ADD jobs since it contains the new chain which has been added to cache. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Set errno in nft_rule_check() if chain not foundPhil Sutter2019-01-112-9/+7
| | | | | | | | | | | | With this, the explicit check for chain existence can be removed from xtables.c since all related commands do this now. Note that this effectively changes the error message printed by iptables-nft when given a non-existing chain, but the new error message(s) conform with those printed by legacy iptables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify flush_chain_cache()Phil Sutter2019-01-091-13/+11
| | | | | | | | | | | | With all the checks for 'tablename' being non-NULL, this code was rather stupid and really hard to read. And the fix is indeed quite simple: If a table name was given, use nft_table_builtin_find() and just flush its chain cache. Otherwise iterate over all builtin tables without any conditionals for 'tablename'. Fixes: d4b0d248cc057 ("nft: Reduce indenting level in flush_chain_cache()") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify nft_is_chain_compatible()Phil Sutter2019-01-091-25/+9
| | | | | | | | | | Make use of nft_{table,chain}_builtin_find() instead of open-coding the list traversal. Since code is pretty obvious now, drop the comments added earlier. Fixes: e774b15299c27 ("nft: Review is_*_compatible() routines") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Make use of nftnl_rule_lookup_byindex()Phil Sutter2018-12-271-13/+18
| | | | | | | | Use the function where suitable to potentially speedup rule cache lookup by rule number. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize list rules command with given chainPhil Sutter2018-12-271-50/+43
| | | | | | | | | | | If a chain name was given, make use of nftnl_chain_list_lookup_byname(). Likewise in nftnl_rule_list_chain_save(), but introduce __nftnl_rule_list_chain_save() suitable for passing to nftnl_chain_list_foreach(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize list command with given chainPhil Sutter2018-12-271-46/+32
| | | | | | | | | Make use of nftnl_chain_list_lookup_byname() even if not listing a specific rule. Introduce __nft_print_header() to consolidate chain value extraction for printing with ops->print_header(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize user-defined chain deletionPhil Sutter2018-12-271-43/+46
| | | | | | | | | Make use of nftnl_chain_list_lookup_byname() if a chain name was given. Move the actual chain deleting code into a callback suitable for passing to nftnl_chain_list_foreach(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Extend verbose output and return code testsPhil Sutter2018-12-272-4/+15
| | | | | | | | | | | | | Recent changes to chain flush and zero routines incorporate proper error propagation so trying to flush or zero a non-existent chain results in an error. This is consistent with iptables-legacy, extend tests to make sure it stays this way. Also extend verbose output test to make these recent changes didn't mess it up. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize nft_chain_zero_counters()Phil Sutter2018-12-271-36/+36
| | | | | | | | | | | | | If a chain name was given, make use of nftnl_chain_list_lookup_byname(). Streamline nft_chain_zero_rule_counters() to be suitable for calling from nftnl_chain_list_foreach(). There is an unrelated optimization in here, too: Add batch job NFT_COMPAT_CHAIN_ZERO only if it is a base chain. Since user-defined chains don't have counters, there is no need to do anything for them. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Optimize flushing a specific chainPhil Sutter2018-12-271-13/+17
| | | | | | | | If a chain name is given to nft_rule_flush(), make use of nftnl_chain_list_lookup_byname(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Drop nft_chain_list_find()Phil Sutter2018-12-272-31/+2
| | | | | | | | Replace the function by nftnl_chain_list_lookup_byname() as provided by libnftnl. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Implement per chain rule cachePhil Sutter2018-12-272-222/+166
| | | | | | | | | | | | | | | Use recently introduced support for rules inside chains in libnftnl to introduce a rule cache per chain instead of a global one. A tricky bit is to decide if cache should be updated or not. Previously, the global rule cache was populated just once and then reused unless being flushed completely (via call to flush_rule_cache() with NULL-pointer table argument). Resemble this behaviour by introducing a boolean indicating cache status and fetch rules for all chains when updating the chain cache in nft_chain_list_get(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Move nft_rule_list_get() above nft_chain_list_get()Phil Sutter2018-12-271-55/+55
| | | | | | | | | | Later when introducing per chain rule caches, nft_rule_list_get() will be removed. But nftnl_rule_list_cb() which it uses will be reused to update each chain's rule cache from inside nftnl_chain_list_get(), so move both into position. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Introduce fetch_chain_cache()Phil Sutter2018-12-271-10/+17
| | | | | | | | Move chain cache population from nft_chain_list_get() into a dedicated function. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify nft_rule_insert() a bitPhil Sutter2018-12-271-4/+1
| | | | | | | Fetch rule list right on top instead of in each branch separately. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify per table chain cache updatePhil Sutter2018-12-271-10/+13
| | | | | | | | | | | | | | | | | | Previously, each table's chain cache was potentially unallocated until nftnl_chain_list_cb() saw a chain for it. This means such callback had to check the chain_cache pointer for each chain belonging to that table. In addition to the above, nft_chain_list_get() had to cover for the possibility that a given table didn't have any chains at all in kernel, so check requested table's chain cache once more and allocate it if NULL. Instead, simply iterate over all tables and preallocate their chain caches prior to requesting the chain list from kernel. The only caveat is to flush the chain cache completely before retrying in case of EINTR. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Reduce indenting level in flush_chain_cache()Phil Sutter2018-12-271-9/+13
| | | | | | | | | | | | | | | Instead of doing all in one go, make two separate decisions: 1) If table has no chain cache, either continue or return depending on whether we're flushing for a specific table. 2) With chain cache present, flushing strategy once more depends on whether we're flushing for a specific table: If given, just remove all rules and return. If not, free the cache and set to NULL (so that it will be repopulated later), then continue the loop. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Reduce __nft_rule_del() signaturePhil Sutter2018-12-271-4/+3
| | | | | | | | The function does not use passed struct nftnl_rule_list, so remove it from its parameters. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Review is_*_compatible() routinesPhil Sutter2018-12-271-98/+55
| | | | | | | | | | | | | | | | - Call to nft_table_builtin_find() in nft_is_table_compatible() is not needed, as it is repeated in the latter call to nft_chain_list_get() by nft_are_chains_compatible(). - Turn nft_is_chain_compatible(), nft_is_rule_compatible() and nft_is_expr_compatible() into callbacks for use with respective foreach functions. - nft_are_chains_compatible() is not needed anymore due to foreach function use. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-restore: Review chain handlingPhil Sutter2018-12-272-51/+19
| | | | | | | | | | | | | | | | | | | | | | | There is no need to "delete" (actually, remove from cache) a chain if noflush wasn't given: While handling the corresponding table line, 'table_flush' callback has already taken care of that. This .chain_del indirection is not required since d1eb4d587297 ("iptables-compat: chains are purge out already from table flush"). Streamlining the code further, move syntax checks to the top. If these concede, there are three cases to distinguish: A) Given chain name matches a builtin one in current table, so assume it exists already and just set policy and counters. B) Noflush was given and the (custom) chain exists already, flush it. C) Custom chain was either flushed (noflush not given) or didn't exist before, create it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Review unclear return pointsPhil Sutter2018-12-261-2/+2
| | | | | | | | | | When converting to per table chain caches, these two error returns were marked for review but apparently forgotten. Make sure error condition is propagated when returning at those points. Fixes: c58ecf9f8bcb7 ("xtables: Introduce per table chain caches") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Simplify nftnl_rule_list_chain_save()Phil Sutter2018-12-261-7/+3
| | | | | | | | | Since there are per table chain caches, The chain list passed to that function is comprised of chains belonging to the right table only. Therefore the table name check can safely be skipped. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>