|
|
|
@ -466,7 +466,7 @@ static const char *delete_chain(struct mnl_socket *nl, int family, uint32_t *seq
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static const char *nftables_shutdown_family(struct mnl_socket *nl, int family, uint32_t *seq,
|
|
|
|
|
const char *chain, const char *base_chain, void *data)
|
|
|
|
|
const char *chain, const char *base_chain, nftables_args *dummy)
|
|
|
|
|
{
|
|
|
|
|
// clean up rules in legacy `INPUT` chain
|
|
|
|
|
const char *err = iterate_rules(nl, family, "INPUT", seq,
|
|
|
|
@ -534,7 +534,7 @@ static const char *add_table(struct mnl_socket *nl, int family, uint32_t *seq) {
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static const char *nftables_setup_family(struct mnl_socket *nl, int family, uint32_t *seq,
|
|
|
|
|
const char *chain, const char *base_chain, void *data)
|
|
|
|
|
const char *chain, const char *base_chain, nftables_args *args)
|
|
|
|
|
{
|
|
|
|
|
const char *err = nftables_shutdown_family(nl, family, seq, chain, base_chain, NULL);
|
|
|
|
|
if (err)
|
|
|
|
@ -545,8 +545,6 @@ static const char *nftables_setup_family(struct mnl_socket *nl, int family, uint
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
int *table = data;
|
|
|
|
|
|
|
|
|
|
if (base_chain) {
|
|
|
|
|
// make sure we have a local input base chain
|
|
|
|
|
err = add_chain(nl, family, base_chain, seq, local_input_chain);
|
|
|
|
@ -571,7 +569,7 @@ static const char *nftables_setup_family(struct mnl_socket *nl, int family, uint
|
|
|
|
|
return add_rule(nl, family, seq, (struct add_rule_callbacks) {
|
|
|
|
|
.callback = rtpe_target,
|
|
|
|
|
.chain = chain,
|
|
|
|
|
.table = *table,
|
|
|
|
|
.table = args->table,
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
else {
|
|
|
|
@ -584,7 +582,7 @@ static const char *nftables_setup_family(struct mnl_socket *nl, int family, uint
|
|
|
|
|
return add_rule(nl, family, seq, (struct add_rule_callbacks) {
|
|
|
|
|
.callback = rtpe_target_filter,
|
|
|
|
|
.chain = chain,
|
|
|
|
|
.table = *table,
|
|
|
|
|
.table = args->table,
|
|
|
|
|
});
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
@ -592,8 +590,8 @@ static const char *nftables_setup_family(struct mnl_socket *nl, int family, uint
|
|
|
|
|
|
|
|
|
|
static const char *nftables_do(const char *chain, const char *base_chain,
|
|
|
|
|
const char *(*do_func)(struct mnl_socket *nl, int family, uint32_t *seq,
|
|
|
|
|
const char *chain, const char *base_chain, void *data),
|
|
|
|
|
void *data)
|
|
|
|
|
const char *chain, const char *base_chain, nftables_args *args),
|
|
|
|
|
nftables_args *args)
|
|
|
|
|
{
|
|
|
|
|
if (!chain || !chain[0])
|
|
|
|
|
return NULL;
|
|
|
|
@ -609,10 +607,10 @@ static const char *nftables_do(const char *chain, const char *base_chain,
|
|
|
|
|
|
|
|
|
|
uint32_t seq = time(NULL);
|
|
|
|
|
|
|
|
|
|
const char *err = do_func(nl, NFPROTO_IPV4, &seq, chain, base_chain, data);
|
|
|
|
|
const char *err = do_func(nl, NFPROTO_IPV4, &seq, chain, base_chain, args);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
err = do_func(nl, NFPROTO_IPV6, &seq, chain, base_chain, data);
|
|
|
|
|
err = do_func(nl, NFPROTO_IPV6, &seq, chain, base_chain, args);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
@ -621,7 +619,7 @@ static const char *nftables_do(const char *chain, const char *base_chain,
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
const char *nftables_setup(const char *chain, const char *base_chain, nftables_args args) {
|
|
|
|
|
return nftables_do(chain, base_chain, nftables_setup_family, &args.table);
|
|
|
|
|
return nftables_do(chain, base_chain, nftables_setup_family, &args);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
const char *nftables_shutdown(const char *chain, const char *base_chain) {
|
|
|
|
|