|
|
|
@ -37,7 +37,8 @@ struct iterate_callbacks { |
|
|
|
|
|
|
|
// scratch area for rule callbacks, set to zero for every rule |
|
|
|
struct { |
|
|
|
bool rule_matched; |
|
|
|
bool imm_jump_matched; |
|
|
|
bool rtpengine_matched; |
|
|
|
bool have_handle; |
|
|
|
int64_t handle; |
|
|
|
} rule_scratch; |
|
|
|
@ -45,7 +46,8 @@ struct iterate_callbacks { |
|
|
|
// scratch area for rule iterating |
|
|
|
struct { |
|
|
|
GQueue handles; |
|
|
|
bool rule_matched; |
|
|
|
bool have_rtpengine_rule; |
|
|
|
bool have_imm_jump_rule; |
|
|
|
} iterate_scratch; |
|
|
|
}; |
|
|
|
|
|
|
|
@ -66,7 +68,7 @@ static const char *match_immediate(const char *name, const int8_t *data, size_t |
|
|
|
if (!strcmp(name, "immediate")) { |
|
|
|
const char *chain = nfapi_get_immediate_chain(data, len); |
|
|
|
if (chain && !strcmp(chain, callbacks->chain)) |
|
|
|
callbacks->rule_scratch.rule_matched = true; |
|
|
|
callbacks->rule_scratch.imm_jump_matched = true; |
|
|
|
} |
|
|
|
return NULL; |
|
|
|
} |
|
|
|
@ -80,7 +82,7 @@ static const char *match_rtpe(const char *name, const int8_t *data, size_t len, |
|
|
|
size_t info_len = sizeof(info); |
|
|
|
const char *n = nfapi_get_target(data, len, &info, &info_len); |
|
|
|
if (n && !strcmp(n, "RTPENGINE") && info_len >= sizeof(info) && info.id == callbacks->table) |
|
|
|
callbacks->rule_scratch.rule_matched = true; |
|
|
|
callbacks->rule_scratch.rtpengine_matched = true; |
|
|
|
} |
|
|
|
return NULL; |
|
|
|
} |
|
|
|
@ -94,7 +96,14 @@ static const char *match_immediate_rtpe(const char *name, const int8_t *data, si |
|
|
|
|
|
|
|
|
|
|
|
static void check_matched_queue(struct iterate_callbacks *callbacks) { |
|
|
|
if (!callbacks->rule_scratch.rule_matched) |
|
|
|
// handle must be known |
|
|
|
if (!callbacks->rule_scratch.have_handle) |
|
|
|
return; |
|
|
|
|
|
|
|
// delete rules which: |
|
|
|
// jump to our handler chain |
|
|
|
// use the rtpengine statement directly |
|
|
|
if (!callbacks->rule_scratch.imm_jump_matched && !callbacks->rule_scratch.rtpengine_matched) |
|
|
|
return; |
|
|
|
|
|
|
|
uint64_t handle = callbacks->rule_scratch.handle; |
|
|
|
@ -103,8 +112,10 @@ static void check_matched_queue(struct iterate_callbacks *callbacks) { |
|
|
|
|
|
|
|
|
|
|
|
static void check_matched_flag(struct iterate_callbacks *callbacks) { |
|
|
|
if (callbacks->rule_scratch.rule_matched) |
|
|
|
callbacks->iterate_scratch.rule_matched = true; |
|
|
|
if (callbacks->rule_scratch.imm_jump_matched) |
|
|
|
callbacks->iterate_scratch.have_imm_jump_rule = true; |
|
|
|
if (callbacks->rule_scratch.rtpengine_matched) |
|
|
|
callbacks->iterate_scratch.have_rtpengine_rule = true; |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@ -687,7 +698,7 @@ static const char *nftables_check_family(nfapi_socket *nl, int family, |
|
|
|
|
|
|
|
iterate_rules(nl, family, chain, &callbacks); |
|
|
|
|
|
|
|
if (!callbacks.iterate_scratch.rule_matched) |
|
|
|
if (!callbacks.iterate_scratch.have_rtpengine_rule) |
|
|
|
return "RTPENGINE rule not found"; |
|
|
|
|
|
|
|
// look for a rule to jump from a base chain to our custom chain |
|
|
|
@ -705,7 +716,7 @@ static const char *nftables_check_family(nfapi_socket *nl, int family, |
|
|
|
if (base_chain && strcmp(base_chain, "none")) |
|
|
|
iterate_rules(nl, family, base_chain, &callbacks); |
|
|
|
|
|
|
|
if (!callbacks.iterate_scratch.rule_matched) |
|
|
|
if (!callbacks.iterate_scratch.have_imm_jump_rule) |
|
|
|
return "immediate-goto rule not found"; |
|
|
|
|
|
|
|
return NULL; |
|
|
|
|