summaryrefslogtreecommitdiffstats
path: root/include/parser.h
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2020-07-04 02:43:44 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2020-07-15 21:56:29 +0200
commitc330152b7f7779f15dba3e0862bf5616e7cb3eab (patch)
tree49c9ab5d837ab99a23e15399acb7ea610606ecfc /include/parser.h
parent1cba7a5e5e96dd920271823125b45e182f22ec82 (diff)
src: support for implicit chain bindings
This patch allows you to group rules in a subchain, e.g. table inet x { chain y { type filter hook input priority 0; tcp dport 22 jump { ip saddr { 127.0.0.0/8, 172.23.0.0/16, 192.168.13.0/24 } accept ip6 saddr ::1/128 accept; } } } This also supports for the `goto' chain verdict. This patch adds a new chain binding list to avoid a chain list lookup from the delinearize path for the usual chains. This can be simplified later on with a single hashtable per table for all chains. From the shell, you have to use the explicit separator ';', in bash you have to escape this: # nft add rule inet x y tcp dport 80 jump { ip saddr 127.0.0.1 accept\; ip6 saddr ::1 accept \; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/parser.h')
-rw-r--r--include/parser.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/include/parser.h b/include/parser.h
index 636d1c88..9baa3a4d 100644
--- a/include/parser.h
+++ b/include/parser.h
@@ -11,7 +11,7 @@
#define YYLTYPE_IS_TRIVIAL 0
#define YYENABLE_NLS 0
-#define SCOPE_NEST_MAX 3
+#define SCOPE_NEST_MAX 4
struct parser_state {
struct input_descriptor *indesc;