Commit 837830a4 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute 



This new netlink attribute allows you to add rules to chains by the
chain ID.

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 74cccc3d

include/uapi/linux/netfilter/nf_tables.h

+1 −0
Original line number Diff line number Diff line
@@ -240,6 +240,7 @@ enum nft_rule_attributes { 
	NFTA_RULE_PAD,

	NFTA_RULE_ID,

	NFTA_RULE_POSITION_ID,

	NFTA_RULE_CHAIN_ID,

	__NFTA_RULE_MAX

};

#define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)

net/netfilter/nf_tables_api.c

+32 −4
Original line number Diff line number Diff line
@@ -2153,6 +2153,22 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, 
	return err;

}



static struct nft_chain *nft_chain_lookup_byid(const struct net *net,

					       const struct nlattr *nla)

{

	u32 id = ntohl(nla_get_be32(nla));

	struct nft_trans *trans;



	list_for_each_entry(trans, &net->nft.commit_list, list) {

		struct nft_chain *chain = trans->ctx.chain;



		if (trans->msg_type == NFT_MSG_NEWCHAIN &&

		    id == nft_trans_chain_id(trans))

			return chain;

	}

	return ERR_PTR(-ENOENT);

}



static int nf_tables_newchain(struct net *net, struct sock *nlsk,

			      struct sk_buff *skb, const struct nlmsghdr *nlh,

			      const struct nlattr * const nla[],
@@ -2633,6 +2649,7 @@ static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { 
				    .len = NFT_USERDATA_MAXLEN },

	[NFTA_RULE_ID]		= { .type = NLA_U32 },

	[NFTA_RULE_POSITION_ID]	= { .type = NLA_U32 },

	[NFTA_RULE_CHAIN_ID]	= { .type = NLA_U32 },

};



static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
@@ -3039,11 +3056,22 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, 
		return PTR_ERR(table);

	}



	chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN], genmask);

	if (nla[NFTA_RULE_CHAIN]) {

		chain = nft_chain_lookup(net, table, nla[NFTA_RULE_CHAIN],

					 genmask);

		if (IS_ERR(chain)) {

			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);

			return PTR_ERR(chain);

		}

	} else if (nla[NFTA_RULE_CHAIN_ID]) {

		chain = nft_chain_lookup_byid(net, nla[NFTA_RULE_CHAIN_ID]);

		if (IS_ERR(chain)) {

			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN_ID]);

			return PTR_ERR(chain);

		}

	} else {

		return -EINVAL;

	}



	if (nla[NFTA_RULE_HANDLE]) {

		handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));