From 2e27f2468ea69bd4ef15b7582e5d0ebe85c80da8 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Thu, 22 Aug 2013 17:26:31 +0200 Subject: src: allow to specify the base chain type This patch allows you to specify the type of the base chain, eg. add table mangle add chain mangle OUTPUT { type route hook NF_INET_LOCAL_OUT 0; } The chain type determines the semantics of the chain, we currently have three types: * filter, used for plain packet filtering. * nat, it only sees the first packet of the flow. * route, which is the equivalent of the iptables mangle table, that triggers a re-route if there is any change in some of the packet header fields, eg. IP TOS/DSCP, or the packet metainformation, eg. mark. Signed-off-by: Pablo Neira Ayuso --- src/netlink.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) (limited to 'src/netlink.c') diff --git a/src/netlink.c b/src/netlink.c index 5129cac6..962561f3 100644 --- a/src/netlink.c +++ b/src/netlink.c @@ -461,6 +461,8 @@ int netlink_add_chain(struct netlink_ctx *ctx, const struct handle *h, chain->hooknum); nft_chain_attr_set_u32(nlc, NFT_CHAIN_ATTR_PRIO, chain->priority); + nft_chain_attr_set_str(nlc, NFT_CHAIN_ATTR_TYPE, + chain->type); } netlink_dump_chain(nlc); err = mnl_nft_chain_add(nf_sock, nlc, NLM_F_EXCL); @@ -524,10 +526,17 @@ static int list_chain_cb(struct nft_chain *nlc, void *arg) xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_NAME)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = - nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE)) { + chain->hooknum = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = + nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = + xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); return 0; @@ -579,8 +588,13 @@ int netlink_get_chain(struct netlink_ctx *ctx, const struct handle *h, chain->handle.family = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_FAMILY); chain->handle.table = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TABLE)); chain->handle.handle = nft_chain_attr_get_u64(nlc, NFT_CHAIN_ATTR_HANDLE); - chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); - chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + if (nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_TYPE) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_HOOKNUM) && + nft_chain_attr_is_set(nlc, NFT_CHAIN_ATTR_PRIO)) { + chain->hooknum = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_HOOKNUM); + chain->priority = nft_chain_attr_get_u32(nlc, NFT_CHAIN_ATTR_PRIO); + chain->type = xstrdup(nft_chain_attr_get_str(nlc, NFT_CHAIN_ATTR_TYPE)); + } list_add_tail(&chain->list, &ctx->list); nft_chain_free(nlc); -- cgit v1.2.3