diff options
author | Arturo Borrero <arturo.borrero.glez@gmail.com> | 2014-03-12 19:03:19 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2014-03-13 14:16:45 +0100 |
commit | b573748a755f5f60449b53d85fb13093461530fb (patch) | |
tree | c8f4cba80408638478fd4e0760c139855fc78482 /src/parser.y | |
parent | d8118b445fa6ef44e839d9717b10dbf8d095feaa (diff) |
ct: add support for setting ct mark
This patch adds the possibility to set ct keys using nft. Currently, the
connection mark is supported. This functionality enables creating rules
performing the same action as iptables -j CONNMARK --save-mark. For example:
table ip filter {
chain postrouting {
type filter hook postrouting priority 0;
ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark
}
}
My patch is based on the original http://patchwork.ozlabs.org/patch/307677/
by Kristian Evensen <kristian.evensen@gmail.com>.
I simply did a rebase and some testing. To test, I added rules like these:
counter meta mark set 1 counter
counter ct mark set mark counter
counter ct mark 1 counter
The last matching worked as expected, which means the second rule is also
working as expected.
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Acked-by: Kristian Evensen <kristian.evensen@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/parser.y')
-rw-r--r-- | src/parser.y | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/parser.y b/src/parser.y index 0d97ae98..db6f4933 100644 --- a/src/parser.y +++ b/src/parser.y @@ -392,6 +392,8 @@ static void location_update(struct location *loc, struct location *rhs, int n) %destructor { stmt_free($$); } stmt match_stmt verdict_stmt %type <stmt> counter_stmt counter_stmt_alloc %destructor { stmt_free($$); } counter_stmt counter_stmt_alloc +%type <stmt> ct_stmt +%destructor { stmt_free($$); } ct_stmt %type <stmt> meta_stmt %destructor { stmt_free($$); } meta_stmt %type <stmt> log_stmt log_stmt_alloc @@ -1069,6 +1071,7 @@ stmt : verdict_stmt | reject_stmt | nat_stmt | queue_stmt + | ct_stmt ; verdict_stmt : verdict_expr @@ -1593,6 +1596,12 @@ ct_key : STATE { $$ = NFT_CT_STATE; } | LABEL { $$ = NFT_CT_LABEL; } ; +ct_stmt : CT ct_key SET expr + { + $$ = ct_stmt_alloc(&@$, $2, $4); + } + ; + payload_expr : payload_raw_expr | eth_hdr_expr | vlan_hdr_expr |