diff --git a/src/evaluate.c b/src/evaluate.c index d4971228b61f..7c72a453d0f3 100644 --- a/src/evaluate.c +++ b/src/evaluate.c @@ -5722,6 +5722,37 @@ static uint32_t str2hooknum(uint32_t family, const char *hook) return NF_INET_NUMHOOKS; } +static int chain_del_evaluate(struct eval_ctx *ctx, struct chain *chain) +{ + struct table *table; + + table = table_cache_find(&ctx->nft->cache.table_cache, + ctx->cmd->handle.table.name, + ctx->cmd->handle.family); + if (table == NULL) + return table_not_found(ctx); + + if (chain->dev_expr) { + if (!(chain->flags & CHAIN_F_BASECHAIN)) + chain->flags |= CHAIN_F_BASECHAIN; + + if (chain->handle.family == NFPROTO_NETDEV || + (chain->handle.family == NFPROTO_INET && + chain->hook.num == NF_INET_INGRESS)) { + if (chain->dev_expr && + !evaluate_device_expr(ctx, &chain->dev_expr)) + return -1; + } else if (chain->dev_expr) { + return __stmt_binary_error(ctx, &chain->dev_expr->location, NULL, + "This chain type cannot be bound to device"); + } + } + + chain_del_cache(ctx, cmd); + + return 0; +} + static int chain_evaluate(struct eval_ctx *ctx, struct chain *chain) { struct table *table;