diff --git a/daemon/nftables.c b/daemon/nftables.c index b5c9ed38b..58bcaa814 100644 --- a/daemon/nftables.c +++ b/daemon/nftables.c @@ -37,7 +37,8 @@ struct iterate_callbacks { // scratch area for rule callbacks, set to zero for every rule struct { - bool rule_matched; + bool imm_jump_matched; + bool rtpengine_matched; bool have_handle; int64_t handle; } rule_scratch; @@ -45,7 +46,8 @@ struct iterate_callbacks { // scratch area for rule iterating struct { GQueue handles; - bool rule_matched; + bool have_rtpengine_rule; + bool have_imm_jump_rule; } iterate_scratch; }; @@ -66,7 +68,7 @@ static const char *match_immediate(const char *name, const int8_t *data, size_t if (!strcmp(name, "immediate")) { const char *chain = nfapi_get_immediate_chain(data, len); if (chain && !strcmp(chain, callbacks->chain)) - callbacks->rule_scratch.rule_matched = true; + callbacks->rule_scratch.imm_jump_matched = true; } return NULL; } @@ -80,7 +82,7 @@ static const char *match_rtpe(const char *name, const int8_t *data, size_t len, size_t info_len = sizeof(info); const char *n = nfapi_get_target(data, len, &info, &info_len); if (n && !strcmp(n, "RTPENGINE") && info_len >= sizeof(info) && info.id == callbacks->table) - callbacks->rule_scratch.rule_matched = true; + callbacks->rule_scratch.rtpengine_matched = true; } return NULL; } @@ -94,7 +96,14 @@ static const char *match_immediate_rtpe(const char *name, const int8_t *data, si static void check_matched_queue(struct iterate_callbacks *callbacks) { - if (!callbacks->rule_scratch.rule_matched) + // handle must be known + if (!callbacks->rule_scratch.have_handle) + return; + + // delete rules which: + // jump to our handler chain + // use the rtpengine statement directly + if (!callbacks->rule_scratch.imm_jump_matched && !callbacks->rule_scratch.rtpengine_matched) return; uint64_t handle = callbacks->rule_scratch.handle; @@ -103,8 +112,10 @@ static void check_matched_queue(struct iterate_callbacks *callbacks) { static void check_matched_flag(struct iterate_callbacks *callbacks) { - if (callbacks->rule_scratch.rule_matched) - callbacks->iterate_scratch.rule_matched = true; + if (callbacks->rule_scratch.imm_jump_matched) + callbacks->iterate_scratch.have_imm_jump_rule = true; + if (callbacks->rule_scratch.rtpengine_matched) + callbacks->iterate_scratch.have_rtpengine_rule = true; } @@ -687,7 +698,7 @@ static const char *nftables_check_family(nfapi_socket *nl, int family, iterate_rules(nl, family, chain, &callbacks); - if (!callbacks.iterate_scratch.rule_matched) + if (!callbacks.iterate_scratch.have_rtpengine_rule) return "RTPENGINE rule not found"; // look for a rule to jump from a base chain to our custom chain @@ -705,7 +716,7 @@ static const char *nftables_check_family(nfapi_socket *nl, int family, if (base_chain && strcmp(base_chain, "none")) iterate_rules(nl, family, base_chain, &callbacks); - if (!callbacks.iterate_scratch.rule_matched) + if (!callbacks.iterate_scratch.have_imm_jump_rule) return "immediate-goto rule not found"; return NULL;