diff options
| -rw-r--r-- | include/libnftnl/rule.h | 1 | ||||
| -rw-r--r-- | include/linux/netfilter/nf_tables.h | 2 | ||||
| -rw-r--r-- | include/rule.h | 1 | ||||
| -rw-r--r-- | src/rule.c | 20 |
4 files changed, 24 insertions, 0 deletions
diff --git a/include/libnftnl/rule.h b/include/libnftnl/rule.h index 8501c86..78bfead 100644 --- a/include/libnftnl/rule.h +++ b/include/libnftnl/rule.h @@ -28,6 +28,7 @@ enum nftnl_rule_attr { NFTNL_RULE_POSITION, NFTNL_RULE_USERDATA, NFTNL_RULE_ID, + NFTNL_RULE_POSITION_ID, __NFTNL_RULE_MAX }; #define NFTNL_RULE_MAX (__NFTNL_RULE_MAX - 1) diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index a3541b5..ac6de5e 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -218,6 +218,7 @@ enum nft_chain_attributes { * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64) * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN) * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32) + * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32) */ enum nft_rule_attributes { NFTA_RULE_UNSPEC, @@ -230,6 +231,7 @@ enum nft_rule_attributes { NFTA_RULE_USERDATA, NFTA_RULE_PAD, NFTA_RULE_ID, + NFTA_RULE_POSITION_ID, __NFTA_RULE_MAX }; #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1) diff --git a/include/rule.h b/include/rule.h index 5edcb6c..036c722 100644 --- a/include/rule.h +++ b/include/rule.h @@ -11,6 +11,7 @@ struct nftnl_rule { uint64_t handle; uint64_t position; uint32_t id; + uint32_t position_id; struct { void *data; uint32_t len; @@ -87,6 +87,7 @@ void nftnl_rule_unset(struct nftnl_rule *r, uint16_t attr) case NFTNL_RULE_POSITION: case NFTNL_RULE_FAMILY: case NFTNL_RULE_ID: + case NFTNL_RULE_POSITION_ID: break; case NFTNL_RULE_USERDATA: xfree(r->user.data); @@ -103,6 +104,7 @@ static uint32_t nftnl_rule_validate[NFTNL_RULE_MAX + 1] = { [NFTNL_RULE_FAMILY] = sizeof(uint32_t), [NFTNL_RULE_POSITION] = sizeof(uint64_t), [NFTNL_RULE_ID] = sizeof(uint32_t), + [NFTNL_RULE_POSITION_ID] = sizeof(uint32_t), }; EXPORT_SYMBOL(nftnl_rule_set_data); @@ -158,6 +160,9 @@ int nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr, case NFTNL_RULE_ID: memcpy(&r->id, data, sizeof(r->id)); break; + case NFTNL_RULE_POSITION_ID: + memcpy(&r->position_id, data, sizeof(r->position_id)); + break; } r->flags |= (1 << attr); return 0; @@ -222,6 +227,9 @@ const void *nftnl_rule_get_data(const struct nftnl_rule *r, uint16_t attr, case NFTNL_RULE_ID: *data_len = sizeof(uint32_t); return &r->id; + case NFTNL_RULE_POSITION_ID: + *data_len = sizeof(uint32_t); + return &r->position_id; } return NULL; } @@ -313,6 +321,8 @@ void nftnl_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_rule *r) } if (r->flags & (1 << NFTNL_RULE_ID)) mnl_attr_put_u32(nlh, NFTA_RULE_ID, htonl(r->id)); + if (r->flags & (1 << NFTNL_RULE_POSITION_ID)) + mnl_attr_put_u32(nlh, NFTA_RULE_POSITION_ID, htonl(r->position_id)); } EXPORT_SYMBOL(nftnl_rule_add_expr); @@ -352,6 +362,7 @@ static int nftnl_rule_parse_attr_cb(const struct nlattr *attr, void *data) abi_breakage(); break; case NFTA_RULE_ID: + case NFTA_RULE_POSITION_ID: if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) abi_breakage(); break; @@ -483,6 +494,10 @@ int nftnl_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_rule *r) r->id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_ID])); r->flags |= (1 << NFTNL_RULE_ID); } + if (tb[NFTA_RULE_POSITION_ID]) { + r->position_id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_POSITION_ID])); + r->flags |= (1 << NFTNL_RULE_POSITION_ID); + } r->family = nfg->nfgen_family; r->flags |= (1 << NFTNL_RULE_FAMILY); @@ -566,6 +581,11 @@ static int nftnl_rule_snprintf_default(char *buf, size_t size, SNPRINTF_BUFFER_SIZE(ret, remain, offset); } + if (r->flags & (1 << NFTNL_RULE_POSITION_ID)) { + ret = snprintf(buf + offset, remain, "%u ", r->position_id); + SNPRINTF_BUFFER_SIZE(ret, remain, offset); + } + ret = snprintf(buf + offset, remain, "\n"); SNPRINTF_BUFFER_SIZE(ret, remain, offset); |