If base chain is "none", the admin is responsible for jumping into the
custom chain. Don't remove jumps the admin migth have setup.
closes#1787
Change-Id: I9980acb12fb1abb0883b22aceab2719087768763
(cherry picked from commit 4cf8be08e3)
When base chain is "none", the admin is required to manage jumping into the
rtpengine chain. The chain can't be deleted if it is still referenced by
another rule, which is common in this configuration.
closes#1787
Change-Id: I8a72e1041a364db60870b5acececc234c8452bab
(cherry picked from commit 2e7e720c94)
Telling netlink to create a chain that already exists should technically
be a no-op, BUT it still sets the policy to whatever was given as a side
effect. Make sure we don't change the policy by explicitly checking for
the chain's existence.
closes#1785
Change-Id: I526a4e2a0f9d1dcc6e0e00a6e273e4df55863d6c
(cherry picked from commit a0ba4d793d)
For the use case with a separate base chain, we want to preempt other
firewall rules by default and insert our immediate jump rule at the
beginning, rather than at the end. Add an option to provide the other
behaviour.
Change-Id: I16171f7c028c89b94823ecc99387771be3ba9443
If we're not using a separate base chain, create the target rule with
the UDP filter in place, same as the "immediate" rule in the case with a
base chain.
Reported in #1732
Change-Id: I0e67a88f5f51e21ba9537c87e2955f910dd6ec2c
Setting the target info of an `expr` object doesn't result on the data
being copied by libnftnl (unlike other objects). Use static storage to
fix invalid pointer usage.
Reported in #984Closes#1731
Change-Id: Ic5c156a83504a24fb618d770ba53cd1ec4fb2435