src: rule: Support NFTA_RULE_POSITION_ID attribute

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/libnftnl/rule.h b/include/libnftnl/rule.h
index 8501c86e03613fa1b6435d5bc042cb2ec53b1941..78bfead1323681f68af22e40a1ba14ed9acfdf47 100644 (file)
--- a/include/libnftnl/rule.h
+++ b/include/libnftnl/rule.h
@@ -28,6 +28,7 @@ enum nftnl_rule_attr {
        NFTNL_RULE_POSITION,
        NFTNL_RULE_USERDATA,
        NFTNL_RULE_ID,
+       NFTNL_RULE_POSITION_ID,
        __NFTNL_RULE_MAX
 };
 #define NFTNL_RULE_MAX (__NFTNL_RULE_MAX - 1)

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index a3541b5a7fc911cd5de84ff1c98529a48f91ad91..ac6de5e642a37ad61883978649ff1a43207c805d 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -218,6 +218,7 @@ enum nft_chain_attributes {
  * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
  * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
  * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
+ * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
  */
 enum nft_rule_attributes {
        NFTA_RULE_UNSPEC,
@@ -230,6 +231,7 @@ enum nft_rule_attributes {
        NFTA_RULE_USERDATA,
        NFTA_RULE_PAD,
        NFTA_RULE_ID,
+       NFTA_RULE_POSITION_ID,
        __NFTA_RULE_MAX
 };
 #define NFTA_RULE_MAX          (__NFTA_RULE_MAX - 1)

diff --git a/include/rule.h b/include/rule.h
index 5edcb6cfcd65c4ee746b98906dcf6f3c809b2652..036c7225d3ed0174447c2da4feacd3ed34739bc2 100644 (file)
--- a/include/rule.h
+++ b/include/rule.h
@@ -11,6 +11,7 @@ struct nftnl_rule {
        uint64_t        handle;
        uint64_t        position;
        uint32_t        id;
+       uint32_t        position_id;
        struct {
                        void            *data;
                        uint32_t        len;

diff --git a/src/rule.c b/src/rule.c
index e5d21ef9ff96a8bf826c7eecdffa4ee0a458a31d..8173fcdd863d92fa55f99e1f37a5b28dbd8ab5b4 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -87,6 +87,7 @@ void nftnl_rule_unset(struct nftnl_rule *r, uint16_t attr)
        case NFTNL_RULE_POSITION:
        case NFTNL_RULE_FAMILY:
        case NFTNL_RULE_ID:
+       case NFTNL_RULE_POSITION_ID:
                break;
        case NFTNL_RULE_USERDATA:
                xfree(r->user.data);
@@ -103,6 +104,7 @@ static uint32_t nftnl_rule_validate[NFTNL_RULE_MAX + 1] = {
        [NFTNL_RULE_FAMILY]             = sizeof(uint32_t),
        [NFTNL_RULE_POSITION]           = sizeof(uint64_t),
        [NFTNL_RULE_ID]                 = sizeof(uint32_t),
+       [NFTNL_RULE_POSITION_ID]        = sizeof(uint32_t),
 };
 
 EXPORT_SYMBOL(nftnl_rule_set_data);
@@ -158,6 +160,9 @@ int nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr,
        case NFTNL_RULE_ID:
                memcpy(&r->id, data, sizeof(r->id));
                break;
+       case NFTNL_RULE_POSITION_ID:
+               memcpy(&r->position_id, data, sizeof(r->position_id));
+               break;
        }
        r->flags |= (1 << attr);
        return 0;
@@ -222,6 +227,9 @@ const void *nftnl_rule_get_data(const struct nftnl_rule *r, uint16_t attr,
        case NFTNL_RULE_ID:
                *data_len = sizeof(uint32_t);
                return &r->id;
+       case NFTNL_RULE_POSITION_ID:
+               *data_len = sizeof(uint32_t);
+               return &r->position_id;
        }
        return NULL;
 }
@@ -313,6 +321,8 @@ void nftnl_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_rule *r)
        }
        if (r->flags & (1 << NFTNL_RULE_ID))
                mnl_attr_put_u32(nlh, NFTA_RULE_ID, htonl(r->id));
+       if (r->flags & (1 << NFTNL_RULE_POSITION_ID))
+               mnl_attr_put_u32(nlh, NFTA_RULE_POSITION_ID, htonl(r->position_id));
 }
 
 EXPORT_SYMBOL(nftnl_rule_add_expr);
@@ -352,6 +362,7 @@ static int nftnl_rule_parse_attr_cb(const struct nlattr *attr, void *data)
                        abi_breakage();
                break;
        case NFTA_RULE_ID:
+       case NFTA_RULE_POSITION_ID:
                if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
                        abi_breakage();
                break;
@@ -483,6 +494,10 @@ int nftnl_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_rule *r)
                r->id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_ID]));
                r->flags |= (1 << NFTNL_RULE_ID);
        }
+       if (tb[NFTA_RULE_POSITION_ID]) {
+               r->position_id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_POSITION_ID]));
+               r->flags |= (1 << NFTNL_RULE_POSITION_ID);
+       }
 
        r->family = nfg->nfgen_family;
        r->flags |= (1 << NFTNL_RULE_FAMILY);
@@ -566,6 +581,11 @@ static int nftnl_rule_snprintf_default(char *buf, size_t size,
                SNPRINTF_BUFFER_SIZE(ret, remain, offset);
        }
 
+       if (r->flags & (1 << NFTNL_RULE_POSITION_ID)) {
+               ret = snprintf(buf + offset, remain, "%u ", r->position_id);
+               SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+       }
+
        ret = snprintf(buf + offset, remain, "\n");
        SNPRINTF_BUFFER_SIZE(ret, remain, offset);