To allow for a batch to contain rules in arbitrary ordering, introduce NFTA_RULE_POSITION_ID attribute which works just like NFTA_RULE_POSITION but contains the ID of another rule within the same batch. This helps iptables-nft-restore handling dumps with mixed insert/append commands correctly. Note that NFTA_RULE_POSITION takes precedence over NFTA_RULE_POSITION_ID, so if the former is present, the latter is ignored.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -219,6 +219,7 @@ enum nft_chain_attributes { · 218 unmodified lines | ||
| 219 | 219 | * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64) |
| 220 | 220 | * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN) |
| 221 | 221 | * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32) |
| 222 | + * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32) | |
| 222 | 223 | */ |
| 223 | 224 | enum nft_rule_attributes { |
| 224 | 225 | NFTA_RULE_UNSPEC, |
| @@ -231,6 +232,7 @@ enum nft_rule_attributes { · 6 unmodified lines | ||
| 231 | 232 | NFTA_RULE_USERDATA, |
| 232 | 233 | NFTA_RULE_PAD, |
| 233 | 234 | NFTA_RULE_ID, |
| 235 | + NFTA_RULE_POSITION_ID, | |
| 234 | 236 | __NFTA_RULE_MAX |
| 235 | 237 | }; |
| 236 | 238 | #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1) |