History

netfilter: nf_tables: allocate handle and delete objects via handle

This patch allows deletion of objects via unique handle which can be listed via '-a' option.

Harsha Sharma committed 8 years ago

Commit 3ecbfd61 parent cc2d5863 files · +153 −14Browse files

Unified · Split

3 files
  1. include/net/netfilter/nf_tables.h +9 −2
  2. include/uapi/linux/netfilter/nf_tables.h +10 −0
  3. net/netfilter/nf_tables_api.c +134 −12
include/net/netfilter/nf_tables.h+9−2
@@ -374,6 +374,7 @@ void nft_unregister_set(struct nft_set_type *type); · 373 unmodified lines
374374 * @list: table set list node
375375 * @bindings: list of set bindings
376376 * @name: name of the set
377+ * @handle: unique handle of the set
377378 * @ktype: key type (numeric type defined by userspace, not used in the kernel)
378379 * @dtype: data type (verdict or numeric type defined by userspace)
379380 * @objtype: object type (see NFT_OBJECT_* definitions)
@@ -396,6 +397,7 @@ struct nft_set { · 16 unmodified lines
396397 struct list_head list;
397398 struct list_head bindings;
398399 char *name;
400+ u64 handle;
399401 u32 ktype;
400402 u32 dtype;
401403 u32 objtype;
@@ -946,6 +948,7 @@ unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv); · 544 unmodified lines
946948 * @objects: stateful objects in the table
947949 * @flowtables: flow tables in the table
948950 * @hgenerator: handle generator state
951+ * @handle: table handle
949952 * @use: number of chain references to this table
950953 * @flags: table flag (see enum nft_table_flags)
951954 * @genmask: generation mask
@@ -959,6 +962,7 @@ struct nft_table { · 7 unmodified lines
959962 struct list_head objects;
960963 struct list_head flowtables;
961964 u64 hgenerator;
965+ u64 handle;
962966 u32 use;
963967 u16 family:6,
964968 flags:8,
@@ -983,9 +987,9 @@ int nft_verdict_dump(struct sk_buff *skb, int type, · 18 unmodified lines
983987 * @name: name of this stateful object
984988 * @genmask: generation mask
985989 * @use: number of references to this stateful object
986− * @data: object data, layout depends on type
990+ * @handle: unique object handle
987991 * @ops: object operations
988− * @data: pointer to object data
992+ * @data: object data, layout depends on type
989993 */
990994 struct nft_object {
991995 struct list_head list;
@@ -993,6 +997,7 @@ struct nft_object { · 1 unmodified line
993997 struct nft_table *table;
994998 u32 genmask:2,
995999 use:30;
1000+ u64 handle;
9961001 /* runtime data below here */
9971002 const struct nft_object_ops *ops ____cacheline_aligned;
9981003 unsigned char data[]
@@ -1074,6 +1079,7 @@ void nft_unregister_obj(struct nft_object_type *obj_type); · 75 unmodified lines
10741079 * @ops_len: number of hooks in array
10751080 * @genmask: generation mask
10761081 * @use: number of references to this flow table
1082+ * @handle: unique object handle
10771083 * @data: rhashtable and garbage collector
10781084 * @ops: array of hooks
10791085 */
@@ -1086,6 +1092,7 @@ struct nft_flowtable { · 6 unmodified lines
10861092 int ops_len;
10871093 u32 genmask:2,
10881094 use:30;
1095+ u64 handle;
10891096 /* runtime data below here */
10901097 struct nf_hook_ops *ops ____cacheline_aligned;
10911098 struct nf_flowtable data;
include/uapi/linux/netfilter/nf_tables.h+10−0
@@ -174,6 +174,8 @@ enum nft_table_attributes { · 173 unmodified lines
174174 NFTA_TABLE_NAME,
175175 NFTA_TABLE_FLAGS,
176176 NFTA_TABLE_USE,
177+ NFTA_TABLE_HANDLE,
178+ NFTA_TABLE_PAD,
177179 __NFTA_TABLE_MAX
178180 };
179181 #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
@@ -317,6 +319,7 @@ enum nft_set_desc_attributes { · 137 unmodified lines
317319 * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
318320 * @NFTA_SET_USERDATA: user data (NLA_BINARY)
319321 * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
322+ * @NFTA_SET_HANDLE: set handle (NLA_U64)
320323 */
321324 enum nft_set_attributes {
322325 NFTA_SET_UNSPEC,
@@ -335,6 +338,7 @@ enum nft_set_attributes { · 12 unmodified lines
335338 NFTA_SET_USERDATA,
336339 NFTA_SET_PAD,
337340 NFTA_SET_OBJ_TYPE,
341+ NFTA_SET_HANDLE,
338342 __NFTA_SET_MAX
339343 };
340344 #define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
@@ -1314,6 +1318,7 @@ enum nft_ct_helper_attributes { · 973 unmodified lines
13141318 * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
13151319 * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
13161320 * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
1321+ * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
13171322 */
13181323 enum nft_object_attributes {
13191324 NFTA_OBJ_UNSPEC,
@@ -1322,6 +1327,8 @@ enum nft_object_attributes { · 2 unmodified lines
13221327 NFTA_OBJ_TYPE,
13231328 NFTA_OBJ_DATA,
13241329 NFTA_OBJ_USE,
1330+ NFTA_OBJ_HANDLE,
1331+ NFTA_OBJ_PAD,
13251332 __NFTA_OBJ_MAX
13261333 };
13271334 #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
@@ -1333,6 +1340,7 @@ enum nft_object_attributes { · 5 unmodified lines
13331340 * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
13341341 * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
13351342 * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
1343+ * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
13361344 */
13371345 enum nft_flowtable_attributes {
13381346 NFTA_FLOWTABLE_UNSPEC,
@@ -1340,6 +1348,8 @@ enum nft_flowtable_attributes { · 1 unmodified line
13401348 NFTA_FLOWTABLE_NAME,
13411349 NFTA_FLOWTABLE_HOOK,
13421350 NFTA_FLOWTABLE_USE,
1351+ NFTA_FLOWTABLE_HANDLE,
1352+ NFTA_FLOWTABLE_PAD,
13431353 __NFTA_FLOWTABLE_MAX
13441354 };
13451355 #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)
net/netfilter/nf_tables_api.c+134−12
@@ -26,6 +26,7 @@ · 25 unmodified lines
2626 static LIST_HEAD(nf_tables_expressions);
2727 static LIST_HEAD(nf_tables_objects);
2828 static LIST_HEAD(nf_tables_flowtables);
29+static u64 table_handle;
2930
3031 static void nft_ctx_init(struct nft_ctx *ctx,
3132 struct net *net,
@@ -332,6 +333,20 @@ static struct nft_table *nft_table_lookup(const struct net *net, · 300 unmodified lines
332333 return NULL;
333334 }
334335
336+static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
337+ const struct nlattr *nla,
338+ u8 genmask)
339+{
340+ struct nft_table *table;
341+
342+ list_for_each_entry(table, &net->nft.tables, list) {
343+ if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
344+ nft_active_genmask(table, genmask))
345+ return table;
346+ }
347+ return NULL;
348+}
349+
335350 static struct nft_table *nf_tables_table_lookup(const struct net *net,
336351 const struct nlattr *nla,
337352 u8 family, u8 genmask)
@@ -348,6 +363,22 @@ static struct nft_table *nf_tables_table_lookup(const struct net *net, · 10 unmodified lines
348363 return ERR_PTR(-ENOENT);
349364 }
350365
366+static struct nft_table *nf_tables_table_lookup_byhandle(const struct net *net,
367+ const struct nlattr *nla,
368+ u8 genmask)
369+{
370+ struct nft_table *table;
371+
372+ if (nla == NULL)
373+ return ERR_PTR(-EINVAL);
374+
375+ table = nft_table_lookup_byhandle(net, nla, genmask);
376+ if (table != NULL)
377+ return table;
378+
379+ return ERR_PTR(-ENOENT);
380+}
381+
351382 static inline u64 nf_tables_alloc_handle(struct nft_table *table)
352383 {
353384 return ++table->hgenerator;
@@ -394,6 +425,7 @@ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = { · 40 unmodified lines
394425 [NFTA_TABLE_NAME] = { .type = NLA_STRING,
395426 .len = NFT_TABLE_MAXNAMELEN - 1 },
396427 [NFTA_TABLE_FLAGS] = { .type = NLA_U32 },
428+ [NFTA_TABLE_HANDLE] = { .type = NLA_U64 },
397429 };
398430
399431 static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
@@ -415,7 +447,9 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net, · 15 unmodified lines
415447
416448 if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
417449 nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
418− nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)))
450+ nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
451+ nla_put_be64(skb, NFTA_TABLE_HANDLE, cpu_to_be64(table->handle),
452+ NFTA_TABLE_PAD))
419453 goto nla_put_failure;
420454
421455 nlmsg_end(skb, nlh);
@@ -674,6 +708,7 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, · 252 unmodified lines
674708 INIT_LIST_HEAD(&table->flowtables);
675709 table->family = family;
676710 table->flags = flags;
711+ table->handle = ++table_handle;
677712
678713 nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
679714 err = nft_trans_table_add(&ctx, NFT_MSG_NEWTABLE);
@@ -791,11 +826,18 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk, · 111 unmodified lines
791826 struct nft_ctx ctx;
792827
793828 nft_ctx_init(&ctx, net, skb, nlh, 0, NULL, NULL, nla);
794− if (family == AF_UNSPEC || nla[NFTA_TABLE_NAME] == NULL)
829+ if (family == AF_UNSPEC ||
830+ (!nla[NFTA_TABLE_NAME] && !nla[NFTA_TABLE_HANDLE]))
795831 return nft_flush(&ctx, family);
796832
797− table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME], family,
798− genmask);
833+ if (nla[NFTA_TABLE_HANDLE])
834+ table = nf_tables_table_lookup_byhandle(net,
835+ nla[NFTA_TABLE_HANDLE],
836+ genmask);
837+ else
838+ table = nf_tables_table_lookup(net, nla[NFTA_TABLE_NAME],
839+ family, genmask);
840+
799841 if (IS_ERR(table))
800842 return PTR_ERR(table);
801843
@@ -1539,6 +1581,7 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk, · 737 unmodified lines
15391581 struct nft_rule *rule;
15401582 int family = nfmsg->nfgen_family;
15411583 struct nft_ctx ctx;
1584+ u64 handle;
15421585 u32 use;
15431586 int err;
15441587
@@ -1547,7 +1590,12 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk, · 2 unmodified lines
15471590 if (IS_ERR(table))
15481591 return PTR_ERR(table);
15491592
1550− chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1593+ if (nla[NFTA_CHAIN_HANDLE]) {
1594+ handle = be64_to_cpu(nla_get_be64(nla[NFTA_CHAIN_HANDLE]));
1595+ chain = nf_tables_chain_lookup_byhandle(table, handle, genmask);
1596+ } else {
1597+ chain = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME], genmask);
1598+ }
15511599 if (IS_ERR(chain))
15521600 return PTR_ERR(chain);
15531601
@@ -2503,6 +2551,7 @@ static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = { · 949 unmodified lines
25032551 [NFTA_SET_USERDATA] = { .type = NLA_BINARY,
25042552 .len = NFT_USERDATA_MAXLEN },
25052553 [NFTA_SET_OBJ_TYPE] = { .type = NLA_U32 },
2554+ [NFTA_SET_HANDLE] = { .type = NLA_U64 },
25062555 };
25072556
25082557 static const struct nla_policy nft_set_desc_policy[NFTA_SET_DESC_MAX + 1] = {
@@ -2546,6 +2595,22 @@ static struct nft_set *nf_tables_set_lookup(const struct nft_table *table, · 37 unmodified lines
25462595 return ERR_PTR(-ENOENT);
25472596 }
25482597
2598+static struct nft_set *nf_tables_set_lookup_byhandle(const struct nft_table *table,
2599+ const struct nlattr *nla, u8 genmask)
2600+{
2601+ struct nft_set *set;
2602+
2603+ if (nla == NULL)
2604+ return ERR_PTR(-EINVAL);
2605+
2606+ list_for_each_entry(set, &table->sets, list) {
2607+ if (be64_to_cpu(nla_get_be64(nla)) == set->handle &&
2608+ nft_active_genmask(set, genmask))
2609+ return set;
2610+ }
2611+ return ERR_PTR(-ENOENT);
2612+}
2613+
25492614 static struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
25502615 const struct nlattr *nla,
25512616 u8 genmask)
@@ -2661,6 +2726,9 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, · 109 unmodified lines
26612726 goto nla_put_failure;
26622727 if (nla_put_string(skb, NFTA_SET_NAME, set->name))
26632728 goto nla_put_failure;
2729+ if (nla_put_be64(skb, NFTA_SET_HANDLE, cpu_to_be64(set->handle),
2730+ NFTA_SET_PAD))
2731+ goto nla_put_failure;
26642732 if (set->flags != 0)
26652733 if (nla_put_be32(skb, NFTA_SET_FLAGS, htonl(set->flags)))
26662734 goto nla_put_failure;
@@ -3069,6 +3137,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, · 402 unmodified lines
30693137 set->udata = udata;
30703138 set->timeout = timeout;
30713139 set->gc_int = gc_int;
3140+ set->handle = nf_tables_alloc_handle(table);
30723141
30733142 err = ops->init(set, &desc, nla);
30743143 if (err < 0)
@@ -3126,7 +3195,10 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk, · 51 unmodified lines
31263195 if (err < 0)
31273196 return err;
31283197
3129− set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
3198+ if (nla[NFTA_SET_HANDLE])
3199+ set = nf_tables_set_lookup_byhandle(ctx.table, nla[NFTA_SET_HANDLE], genmask);
3200+ else
3201+ set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME], genmask);
31303202 if (IS_ERR(set))
31313203 return PTR_ERR(set);
31323204
@@ -4256,6 +4328,21 @@ struct nft_object *nf_tables_obj_lookup(const struct nft_table *table, · 1123 unmodified lines
42564328 }
42574329 EXPORT_SYMBOL_GPL(nf_tables_obj_lookup);
42584330
4331+struct nft_object *nf_tables_obj_lookup_byhandle(const struct nft_table *table,
4332+ const struct nlattr *nla,
4333+ u32 objtype, u8 genmask)
4334+{
4335+ struct nft_object *obj;
4336+
4337+ list_for_each_entry(obj, &table->objects, list) {
4338+ if (be64_to_cpu(nla_get_be64(nla)) == obj->handle &&
4339+ objtype == obj->ops->type->type &&
4340+ nft_active_genmask(obj, genmask))
4341+ return obj;
4342+ }
4343+ return ERR_PTR(-ENOENT);
4344+}
4345+
42594346 static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = {
42604347 [NFTA_OBJ_TABLE] = { .type = NLA_STRING,
42614348 .len = NFT_TABLE_MAXNAMELEN - 1 },
@@ -4263,6 +4350,7 @@ static const struct nla_policy nft_obj_policy[NFTA_OBJ_MAX + 1] = { · 1 unmodified line
42634350 .len = NFT_OBJ_MAXNAMELEN - 1 },
42644351 [NFTA_OBJ_TYPE] = { .type = NLA_U32 },
42654352 [NFTA_OBJ_DATA] = { .type = NLA_NESTED },
4353+ [NFTA_OBJ_HANDLE] = { .type = NLA_U64},
42664354 };
42674355
42684356 static struct nft_object *nft_obj_init(const struct nft_ctx *ctx,
@@ -4410,6 +4498,8 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, · 141 unmodified lines
44104498 goto err1;
44114499 }
44124500 obj->table = table;
4501+ obj->handle = nf_tables_alloc_handle(table);
4502+
44134503 obj->name = nla_strdup(nla[NFTA_OBJ_NAME], GFP_KERNEL);
44144504 if (!obj->name) {
44154505 err = -ENOMEM;
@@ -4456,7 +4546,9 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net, · 40 unmodified lines
44564546 nla_put_string(skb, NFTA_OBJ_NAME, obj->name) ||
44574547 nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
44584548 nla_put_be32(skb, NFTA_OBJ_USE, htonl(obj->use)) ||
4459− nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset))
4549+ nft_object_dump(skb, NFTA_OBJ_DATA, obj, reset) ||
4550+ nla_put_be64(skb, NFTA_OBJ_HANDLE, cpu_to_be64(obj->handle),
4551+ NFTA_OBJ_PAD))
44604552 goto nla_put_failure;
44614553
44624554 nlmsg_end(skb, nlh);
@@ -4654,7 +4746,7 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk, · 191 unmodified lines
46544746 u32 objtype;
46554747
46564748 if (!nla[NFTA_OBJ_TYPE] ||
4657− !nla[NFTA_OBJ_NAME])
4749+ (!nla[NFTA_OBJ_NAME] && !nla[NFTA_OBJ_HANDLE]))
46584750 return -EINVAL;
46594751
46604752 table = nf_tables_table_lookup(net, nla[NFTA_OBJ_TABLE], family,
@@ -4663,7 +4755,12 @@ static int nf_tables_delobj(struct net *net, struct sock *nlsk, · 2 unmodified lines
46634755 return PTR_ERR(table);
46644756
46654757 objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
4666− obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME], objtype, genmask);
4758+ if (nla[NFTA_OBJ_HANDLE])
4759+ obj = nf_tables_obj_lookup_byhandle(table, nla[NFTA_OBJ_HANDLE],
4760+ objtype, genmask);
4761+ else
4762+ obj = nf_tables_obj_lookup(table, nla[NFTA_OBJ_NAME],
4763+ objtype, genmask);
46674764 if (IS_ERR(obj))
46684765 return PTR_ERR(obj);
46694766 if (obj->use > 0)
@@ -4735,6 +4832,7 @@ static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { · 65 unmodified lines
47354832 [NFTA_FLOWTABLE_NAME] = { .type = NLA_STRING,
47364833 .len = NFT_NAME_MAXLEN - 1 },
47374834 [NFTA_FLOWTABLE_HOOK] = { .type = NLA_NESTED },
4835+ [NFTA_FLOWTABLE_HANDLE] = { .type = NLA_U64 },
47384836 };
47394837
47404838 struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table,
@@ -4752,6 +4850,20 @@ struct nft_flowtable *nf_tables_flowtable_lookup(const struct nft_table *table, · 11 unmodified lines
47524850 }
47534851 EXPORT_SYMBOL_GPL(nf_tables_flowtable_lookup);
47544852
4853+struct nft_flowtable *
4854+nf_tables_flowtable_lookup_byhandle(const struct nft_table *table,
4855+ const struct nlattr *nla, u8 genmask)
4856+{
4857+ struct nft_flowtable *flowtable;
4858+
4859+ list_for_each_entry(flowtable, &table->flowtables, list) {
4860+ if (be64_to_cpu(nla_get_be64(nla)) == flowtable->handle &&
4861+ nft_active_genmask(flowtable, genmask))
4862+ return flowtable;
4863+ }
4864+ return ERR_PTR(-ENOENT);
4865+}
4866+
47554867 #define NFT_FLOWTABLE_DEVICE_MAX 8
47564868
47574869 static int nf_tables_parse_devices(const struct nft_ctx *ctx,
@@ -4960,6 +5072,8 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk, · 202 unmodified lines
49605072 return -ENOMEM;
49615073
49625074 flowtable->table = table;
5075+ flowtable->handle = nf_tables_alloc_handle(table);
5076+
49635077 flowtable->name = nla_strdup(nla[NFTA_FLOWTABLE_NAME], GFP_KERNEL);
49645078 if (!flowtable->name) {
49655079 err = -ENOMEM;
@@ -5034,8 +5148,14 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk, · 68 unmodified lines
50345148 if (IS_ERR(table))
50355149 return PTR_ERR(table);
50365150
5037− flowtable = nf_tables_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],
5038− genmask);
5151+ if (nla[NFTA_FLOWTABLE_HANDLE])
5152+ flowtable = nf_tables_flowtable_lookup_byhandle(table,
5153+ nla[NFTA_FLOWTABLE_HANDLE],
5154+ genmask);
5155+ else
5156+ flowtable = nf_tables_flowtable_lookup(table,
5157+ nla[NFTA_FLOWTABLE_NAME],
5158+ genmask);
50395159 if (IS_ERR(flowtable))
50405160 return PTR_ERR(flowtable);
50415161 if (flowtable->use > 0)
@@ -5068,7 +5188,9 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, · 26 unmodified lines
50685188
50695189 if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
50705190 nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
5071− nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)))
5191+ nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
5192+ nla_put_be64(skb, NFTA_FLOWTABLE_HANDLE, cpu_to_be64(flowtable->handle),
5193+ NFTA_FLOWTABLE_PAD))
50725194 goto nla_put_failure;
50735195
50745196 nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);