diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-08-22 17:26:31 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-08-27 00:38:01 +0200 |
| commit | 2e27f2468ea69bd4ef15b7582e5d0ebe85c80da8 (patch) | |
| tree | 22ca140eb616714782908c7843559a6981afb9b9 /src/netlink.c | |
| parent | facb3d65ae911418ee10ca2fd1c1ed9a9749cf3b (diff) | |
src: allow to specify the base chain type
This patch allows you to specify the type of the base chain, eg.
add table mangle
add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; }
The chain type determines the semantics of the chain, we currently
have three types:
* filter, used for plain packet filtering.
* nat, it only sees the first packet of the flow.
* route, which is the equivalent of the iptables mangle table, that
triggers a re-route if there is any change in some of the packet header
fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink.c')
| -rw-r--r-- | src/netlink.c | 26 |
1 files changed, 20 insertions, 6 deletions
diff --git a/src/netlink.c b/src/netlink.c index 5129cac6..962561f3 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -461,6 +461,8 @@ int netlink_add_chain(struct netlink_ctx *ctx, const struct handle *h, chain->hooknum); nft_chain_attr_set_u32(nlc, NFT_CHAIN_ATTR_PRIO, chain->priority); + nft_chain_attr_set_str(nlc, NFT_CHAIN_ATTR_TYPE, + chain->type); } netlink_dump_chain(nlc); err = mnl_nft_chain_add(nf_sock, nlc, NLM_F_EXCL); @@ -524,10 +526,17 @@ static int list_chain_cb(struct nft_chain *nlc, void *arg) xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_NAME)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE)) { + chain->hooknum = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = + xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); return 0; @@ -579,8 +588,13 @@ int netlink_get_chain(struct netlink_ctx *ctx, const struct handle *h, chain->handle.family = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_FAMILY); chain->handle.table = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TABLE)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO)) { + chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); nft_chain_free(nlc); |