diff options
| -rw-r--r-- | include/rule.h | 2 | ||||
| -rw-r--r-- | src/netlink.c | 26 | ||||
| -rw-r--r-- | src/parser.y | 14 | ||||
| -rw-r--r-- | src/rule.c | 5 |
4 files changed, 32 insertions, 15 deletions
diff --git a/include/rule.h b/include/rule.h index 2577cff5..4f684319 100644 --- a/include/rule.h +++ b/include/rule.h @@ -100,6 +100,7 @@ enum chain_flags { * @flags: chain flags * @hooknum: hook number (base chains) * @priority: hook priority (base chains) + * @type: chain type * @rules: rules contained in the chain */ struct chain { @@ -109,6 +110,7 @@ struct chain { uint32_t flags; unsigned int hooknum; unsigned int priority; + const char *type; struct scope scope; struct list_head rules; }; diff --git a/src/netlink.c b/src/netlink.c index 5129cac6..962561f3 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -461,6 +461,8 @@ int netlink_add_chain(struct netlink_ctx *ctx, const struct handle *h, chain->hooknum); nft_chain_attr_set_u32(nlc, NFT_CHAIN_ATTR_PRIO, chain->priority); + nft_chain_attr_set_str(nlc, NFT_CHAIN_ATTR_TYPE, + chain->type); } netlink_dump_chain(nlc); err = mnl_nft_chain_add(nf_sock, nlc, NLM_F_EXCL); @@ -524,10 +526,17 @@ static int list_chain_cb(struct nft_chain *nlc, void *arg) xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_NAME)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE)) { + chain->hooknum = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = + xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); return 0; @@ -579,8 +588,13 @@ int netlink_get_chain(struct netlink_ctx *ctx, const struct handle *h, chain->handle.family = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_FAMILY); chain->handle.table = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TABLE)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO)) { + chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); nft_chain_free(nlc); diff --git a/src/parser.y b/src/parser.y index ff8de47f..f0eb8e32 100644 --- a/src/parser.y +++ b/src/parser.y @@ -766,16 +766,18 @@ map_block : /* empty */ { $$ = $<set>-1; } } ; -hook_spec : HOOK HOOKNUM NUM +hook_spec : TYPE STRING HOOK HOOKNUM NUM { - $<chain>0->hooknum = $2; - $<chain>0->priority = $3; + $<chain>0->type = $2; + $<chain>0->hooknum = $4; + $<chain>0->priority = $5; $<chain>0->flags |= CHAIN_F_BASECHAIN; } - | HOOK HOOKNUM DASH NUM + | TYPE STRING HOOK HOOKNUM DASH NUM { - $<chain>0->hooknum = $2; - $<chain>0->priority = -$4; + $<chain>0->type = $2; + $<chain>0->hooknum = $4; + $<chain>0->priority = -$6; $<chain>0->flags |= CHAIN_F_BASECHAIN; } ; @@ -250,9 +250,8 @@ static void chain_print(const struct chain *chain) printf("\tchain %s {\n", chain->handle.chain); if (chain->hooknum) { - printf("\t\t hook %s %u;\n", - hooknum2str(chain->hooknum), - chain->priority); + printf("\t\t type %s hook %s %u;\n", chain->type, + hooknum2str(chain->hooknum), chain->priority); } list_for_each_entry(rule, &chain->rules, list) { printf("\t\t"); |