History

netfilter: nf_tables: add NFTA_VERDICT_CHAIN_ID attribute

This netlink attribute allows you to identify the chain to jump/goto by means of the chain ID.

Pablo Neira Ayuso committed 6 years ago

Commit 51d70f11 parent 837830a2 files · +15 −3Browse files

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_tables.h +2 −0
  2. net/netfilter/nf_tables_api.c +13 −3
include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -471,11 +471,13 @@ enum nft_data_attributes { · 470 unmodified lines
471 *471 *
472 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)472 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
473 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)473 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
474 * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
474 */475 */
475enum nft_verdict_attributes {476enum nft_verdict_attributes {
476 NFTA_VERDICT_UNSPEC,477 NFTA_VERDICT_UNSPEC,
477 NFTA_VERDICT_CODE,478 NFTA_VERDICT_CODE,
478 NFTA_VERDICT_CHAIN,479 NFTA_VERDICT_CHAIN,
480 NFTA_VERDICT_CHAIN_ID,
479 __NFTA_VERDICT_MAX481 __NFTA_VERDICT_MAX
480};482};
481#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)483#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
net/netfilter/nf_tables_api.c+13−3
@@ -8242,6 +8242,7 @@ static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { · 8241 unmodified lines
8242 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },8242 [NFTA_VERDICT_CODE] = { .type = NLA_U32 },
8243 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,8243 [NFTA_VERDICT_CHAIN] = { .type = NLA_STRING,
8244 .len = NFT_CHAIN_MAXNAMELEN - 1 },8244 .len = NFT_CHAIN_MAXNAMELEN - 1 },
8245 [NFTA_VERDICT_CHAIN_ID] = { .type = NLA_U32 },
8245};8246};
8246 8247
8247static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,8248static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
@@ -8278,10 +8279,19 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, · 30 unmodified lines
8278 break;8279 break;
8279 case NFT_JUMP:8280 case NFT_JUMP:
8280 case NFT_GOTO:8281 case NFT_GOTO:
8281 if (!tb[NFTA_VERDICT_CHAIN])8282 if (tb[NFTA_VERDICT_CHAIN]) {
8283 chain = nft_chain_lookup(ctx->net, ctx->table,
8284 tb[NFTA_VERDICT_CHAIN],
8285 genmask);
8286 } else if (tb[NFTA_VERDICT_CHAIN_ID]) {
8287 chain = nft_chain_lookup_byid(ctx->net,
8288 tb[NFTA_VERDICT_CHAIN_ID]);
8289 if (IS_ERR(chain))
8290 return PTR_ERR(chain);
8291 } else {
8282 return -EINVAL;8292 return -EINVAL;
8283 chain = nft_chain_lookup(ctx->net, ctx->table,8293 }
8284 tb[NFTA_VERDICT_CHAIN], genmask);8294
8285 if (IS_ERR(chain))8295 if (IS_ERR(chain))
8286 return PTR_ERR(chain);8296 return PTR_ERR(chain);
8287 if (nft_is_base_chain(chain))8297 if (nft_is_base_chain(chain))