History

netfilter: nf_tables: add NFTA_VERDICT_CHAIN_ID attribute

This netlink attribute allows you to identify the chain to jump/goto by means of the chain ID.

Pablo Neira Ayuso committed 6 years ago

Commit 51d70f11 parent 837830a2 files · +15 −3Browse files

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_tables.h +2 −0
  2. net/netfilter/nf_tables_api.c +13 −3
include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -471,11 +471,13 @@ enum nft_data_attributes { · 470 unmodified lines
471471 *
472472 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
473473 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
474+ * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
474475 */
475476 enum nft_verdict_attributes {
476477 NFTA_VERDICT_UNSPEC,
477478 NFTA_VERDICT_CODE,
478479 NFTA_VERDICT_CHAIN,
480+ NFTA_VERDICT_CHAIN_ID,
479481 __NFTA_VERDICT_MAX
480482 };
481483 #define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
net/netfilter/nf_tables_api.c+13−3
@@ -8242,6 +8242,7 @@ static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { · 8241 unmodified lines
82428242 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
82438243 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
82448244 .len = NFT_CHAIN_MAXNAMELEN - 1 },
8245+ [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
82458246 };
82468247
82478248 static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
@@ -8278,10 +8279,19 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, · 30 unmodified lines
82788279 break;
82798280 case NFT_JUMP:
82808281 case NFT_GOTO:
8281− if (!tb[NFTA_VERDICT_CHAIN])
8282+ if (tb[NFTA_VERDICT_CHAIN]) {
8283+ chain = nft_chain_lookup(ctx->net, ctx->table,
8284+ tb[NFTA_VERDICT_CHAIN],
8285+ genmask);
8286+ } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
8287+ chain = nft_chain_lookup_byid(ctx->net,
8288+ tb[NFTA_VERDICT_CHAIN_ID]);
8289+ if (IS_ERR(chain))
8290+ return PTR_ERR(chain);
8291+ } else {
82828292 return -EINVAL;
8283− chain = nft_chain_lookup(ctx->net, ctx->table,
8284− tb[NFTA_VERDICT_CHAIN], genmask);
8293+ }
8294+
82858295 if (IS_ERR(chain))
82868296 return PTR_ERR(chain);
82878297 if (nft_is_base_chain(chain))