126 lines
3.8 KiB
Diff
126 lines
3.8 KiB
Diff
From 61c295c9dec447239ed2c84b0073594ffecf7554 Mon Sep 17 00:00:00 2001
|
|
From: Phil Sutter <psutter@redhat.com>
|
|
Date: Wed, 27 Apr 2022 14:46:47 +0200
|
|
Subject: [PATCH] src: add CMD_OBJ_SETELEMS
|
|
|
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2073287
|
|
Upstream Status: nftables commit c9eae091983ae
|
|
Conflicts: Context change due to missing commit 086ec6f30c96e
|
|
("mnl: extended error support for create command").
|
|
|
|
commit c9eae091983ae9ffcf2ca5b666bc03d5a1916c2f
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Fri May 8 14:44:03 2020 +0200
|
|
|
|
src: add CMD_OBJ_SETELEMS
|
|
|
|
This new command type results from expanding the set definition in two
|
|
commands: One to add the set and another to add the elements. This
|
|
results in 1:1 mapping between the command object to the netlink API.
|
|
The command is then translated into a netlink message which gets a
|
|
unique sequence number. This sequence number allows to correlate the
|
|
netlink extended error reporting with the corresponding command.
|
|
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
---
|
|
include/rule.h | 2 ++
|
|
src/rule.c | 23 +++++++++++++++++++----
|
|
2 files changed, 21 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/include/rule.h b/include/rule.h
|
|
index 7fe607f..1efd4fb 100644
|
|
--- a/include/rule.h
|
|
+++ b/include/rule.h
|
|
@@ -545,6 +545,7 @@ enum cmd_ops {
|
|
* @CMD_OBJ_ELEMENTS: set element(s)
|
|
* @CMD_OBJ_SET: set
|
|
* @CMD_OBJ_SETS: multiple sets
|
|
+ * @CMD_OBJ_SETELEMS: set elements
|
|
* @CMD_OBJ_RULE: rule
|
|
* @CMD_OBJ_CHAIN: chain
|
|
* @CMD_OBJ_CHAINS: multiple chains
|
|
@@ -572,6 +573,7 @@ enum cmd_obj {
|
|
CMD_OBJ_INVALID,
|
|
CMD_OBJ_ELEMENTS,
|
|
CMD_OBJ_SET,
|
|
+ CMD_OBJ_SETELEMS,
|
|
CMD_OBJ_SETS,
|
|
CMD_OBJ_RULE,
|
|
CMD_OBJ_CHAIN,
|
|
diff --git a/src/rule.c b/src/rule.c
|
|
index afb6dc9..c43e0cd 100644
|
|
--- a/src/rule.c
|
|
+++ b/src/rule.c
|
|
@@ -1352,11 +1352,11 @@ struct cmd *cmd_alloc(enum cmd_ops op, enum cmd_obj obj,
|
|
void nft_cmd_expand(struct cmd *cmd)
|
|
{
|
|
struct list_head new_cmds;
|
|
+ struct set *set, *newset;
|
|
struct flowtable *ft;
|
|
struct table *table;
|
|
struct chain *chain;
|
|
struct rule *rule;
|
|
- struct set *set;
|
|
struct obj *obj;
|
|
struct cmd *new;
|
|
struct handle h;
|
|
@@ -1412,6 +1412,18 @@ void nft_cmd_expand(struct cmd *cmd)
|
|
}
|
|
list_splice(&new_cmds, &cmd->list);
|
|
break;
|
|
+ case CMD_OBJ_SET:
|
|
+ set = cmd->set;
|
|
+ memset(&h, 0, sizeof(h));
|
|
+ handle_merge(&h, &set->handle);
|
|
+ newset = set_clone(set);
|
|
+ newset->handle.set_id = set->handle.set_id;
|
|
+ newset->init = set->init;
|
|
+ set->init = NULL;
|
|
+ new = cmd_alloc(CMD_ADD, CMD_OBJ_SETELEMS, &h,
|
|
+ &set->location, newset);
|
|
+ list_add(&new->list, &cmd->list);
|
|
+ break;
|
|
default:
|
|
break;
|
|
}
|
|
@@ -1460,6 +1472,7 @@ void cmd_free(struct cmd *cmd)
|
|
expr_free(cmd->expr);
|
|
break;
|
|
case CMD_OBJ_SET:
|
|
+ case CMD_OBJ_SETELEMS:
|
|
set_free(cmd->set);
|
|
break;
|
|
case CMD_OBJ_RULE:
|
|
@@ -1545,7 +1558,7 @@ static int do_add_setelems(struct netlink_ctx *ctx, struct cmd *cmd,
|
|
}
|
|
|
|
static int do_add_set(struct netlink_ctx *ctx, const struct cmd *cmd,
|
|
- uint32_t flags)
|
|
+ uint32_t flags, bool add)
|
|
{
|
|
struct set *set = cmd->set;
|
|
|
|
@@ -1556,7 +1569,7 @@ static int do_add_set(struct netlink_ctx *ctx, const struct cmd *cmd,
|
|
&ctx->nft->output) < 0)
|
|
return -1;
|
|
}
|
|
- if (mnl_nft_set_add(ctx, cmd, flags) < 0)
|
|
+ if (add && mnl_nft_set_add(ctx, cmd, flags) < 0)
|
|
return -1;
|
|
if (set->init != NULL) {
|
|
return __do_add_setelems(ctx, set, set->init, flags);
|
|
@@ -1579,7 +1592,9 @@ static int do_command_add(struct netlink_ctx *ctx, struct cmd *cmd, bool excl)
|
|
case CMD_OBJ_RULE:
|
|
return mnl_nft_rule_add(ctx, cmd, flags | NLM_F_APPEND);
|
|
case CMD_OBJ_SET:
|
|
- return do_add_set(ctx, cmd, flags);
|
|
+ return do_add_set(ctx, cmd, flags, true);
|
|
+ case CMD_OBJ_SETELEMS:
|
|
+ return do_add_set(ctx, cmd, flags, false);
|
|
case CMD_OBJ_ELEMENTS:
|
|
return do_add_setelems(ctx, cmd, flags);
|
|
case CMD_OBJ_COUNTER:
|
|
--
|
|
2.34.1
|
|
|