On Tue, Jul 21, 2015 at 03:45:40PM +0200, Thomas Woerner wrote: > Here are the first patches from my tests with iptables-compat and firewalld: > > The first patch is enabling to insert a rule into rule_count+1 position. > # iptables-compat -t filter -S INPUT > -P INPUT ACCEPT > [0:0] -A INPUT -s 1.2.3.4/32 -j DROP > # iptables-compat -t filter -I INPUT 2 -s 1.2.3.5 -j DROP > # iptables-compat -t filter -S INPUT > -P INPUT ACCEPT > [0:0] -A INPUT -s 1.2.3.4/32 -j DROP > [0:0] -A INPUT -s 1.2.3.5/32 -j DROP > This is possible with iptables, but not possible with iptables-compat. > Maybe it would be good to add nft_rule_list_count or similar and use it here. > > The second patch fixes the rule number handling in nft_rule_find and > __nft_rule_list. The rule number is only valid in the selected table and chain > and therefore may not be increased for other tables or chains. With this patch > the correct rule will be removed with -D <name> i and listed with -S <name> i. Series applied, thanks Thomas! -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
