History

netfilter: nf_tables: Support RULE_ID reference in new rule

To allow for a batch to contain rules in arbitrary ordering, introduce NFTA_RULE_POSITION_ID attribute which works just like NFTA_RULE_POSITION but contains the ID of another rule within the same batch. This helps iptables-nft-restore handling dumps with mixed insert/append commands correctly. Note that NFTA_RULE_POSITION takes precedence over NFTA_RULE_POSITION_ID, so if the former is present, the latter is ignored.

Phil Sutter committed 7 years ago

Commit 75dd48e1 parent 8e2f3112 files · +11 −0Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -219,6 +219,7 @@ enum nft_chain_attributes { · 218 unmodified lines
219 * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)219 * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
220 * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)220 * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
221 * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)221 * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
222 * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
222 */223 */
223enum nft_rule_attributes {224enum nft_rule_attributes {
224 NFTA_RULE_UNSPEC,225 NFTA_RULE_UNSPEC,
@@ -231,6 +232,7 @@ enum nft_rule_attributes { · 6 unmodified lines
231 NFTA_RULE_USERDATA,232 NFTA_RULE_USERDATA,
232 NFTA_RULE_PAD,233 NFTA_RULE_PAD,
233 NFTA_RULE_ID,234 NFTA_RULE_ID,
235 NFTA_RULE_POSITION_ID,
234 __NFTA_RULE_MAX236 __NFTA_RULE_MAX
235};237};
236#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)238#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)