netfilter: support for element deletion

This patch implements element deletion from ruleset.

Example:

	table ip set-test {
		set testset {
			type ipv4_addr;
			flags timeout;
		}

		chain outputchain {
			policy accept;
			type filter hook output priority filter;

			delete @testset { ip saddr }
		}
	}

Signed-off-by: Ander Juaristi <a@juaristi.eus>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index 82abaa183fc30623fac2edf08dbae404cbd3bb14..ec1533990b01d5ebdfa970ddd62bf1b8de4b679f 100644 (file)
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -636,6 +636,7 @@ enum nft_lookup_attributes {
 enum nft_dynset_ops {
        NFT_DYNSET_OP_ADD,
        NFT_DYNSET_OP_UPDATE,
+       NFT_DYNSET_OP_DELETE,
 };
 
 enum nft_dynset_flags {

diff --git a/src/parser_bison.y b/src/parser_bison.y
index bff5e274c7872199d94dd96b424e9f2356d87864..5fb3a60ab5cf4ded9ea548b1f4803de5968cf1b2 100644 (file)
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -3134,6 +3134,7 @@ set_stmt          :       SET     set_stmt_op     set_elem_expr_stmt      symbol_expr
 
 set_stmt_op            :       ADD     { $$ = NFT_DYNSET_OP_ADD; }
                        |       UPDATE  { $$ = NFT_DYNSET_OP_UPDATE; }
+                       |       DELETE  { $$ = NFT_DYNSET_OP_DELETE; }
                        ;
 
 map_stmt               :       set_stmt_op     symbol_expr '{' set_elem_expr_stmt      COLON   set_elem_expr_stmt      '}'

diff --git a/src/statement.c b/src/statement.c
index a9e72de3edfdcfa662468a55acd9748548d3a82a..12689ee51043652619e4a8511e34ba4da2106212 100644 (file)
--- a/src/statement.c
+++ b/src/statement.c
@@ -665,6 +665,7 @@ struct stmt *nat_stmt_alloc(const struct location *loc,
 const char * const set_stmt_op_names[] = {
        [NFT_DYNSET_OP_ADD]     = "add",
        [NFT_DYNSET_OP_UPDATE]  = "update",
+       [NFT_DYNSET_OP_DELETE]  = "delete",
 };
 
 static void set_stmt_print(const struct stmt *stmt, struct output_ctx *octx)