diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-21 10:28:37 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-21 18:49:07 +0200 |
| commit | 7f742d0a9071f932836b4f8525a6d3f7261ae083 (patch) | |
| tree | cd972674de9ea2efbd6e39747acd435b100bf154 /src/parser_bison.y | |
| parent | fb5a36ad5c1032244cf76171648fdefbbe571519 (diff) | |
ct: support for NFT_CT_{SRC,DST}_{IP,IP6}
These keys are available since kernel >= 4.17.
You can still use NFT_CT_{SRC,DST}, however, you need to specify 'meta
protocol' in first place to provide layer 3 context.
Note that NFT_CT_{SRC,DST} are broken with set, maps and concatenations.
This patch is implicitly fixing these cases.
If your kernel is < 4.17, you can still use address matching via
explicit meta nfproto:
meta nfproto ipv4 ct original saddr 1.2.3.4
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/parser_bison.y')
| -rw-r--r-- | src/parser_bison.y | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/src/parser_bison.y b/src/parser_bison.y index 1c0b60cf..670e91f5 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -4060,15 +4060,15 @@ rt_key : CLASSID { $$ = NFT_RT_CLASSID; } ct_expr : CT ct_key { - $$ = ct_expr_alloc(&@$, $2, -1, NFPROTO_UNSPEC); + $$ = ct_expr_alloc(&@$, $2, -1); } | CT ct_dir ct_key_dir { - $$ = ct_expr_alloc(&@$, $3, $2, NFPROTO_UNSPEC); + $$ = ct_expr_alloc(&@$, $3, $2); } - | CT ct_dir nf_key_proto ct_key_proto_field + | CT ct_dir ct_key_proto_field { - $$ = ct_expr_alloc(&@$, $4, $2, $3); + $$ = ct_expr_alloc(&@$, $3, $2); } ; @@ -4102,8 +4102,10 @@ ct_key_dir : SADDR { $$ = NFT_CT_SRC; } | ct_key_dir_optional ; -ct_key_proto_field : SADDR { $$ = NFT_CT_SRC; } - | DADDR { $$ = NFT_CT_DST; } +ct_key_proto_field : IP SADDR { $$ = NFT_CT_SRC_IP; } + | IP DADDR { $$ = NFT_CT_DST_IP; } + | IP6 SADDR { $$ = NFT_CT_SRC_IP6; } + | IP6 DADDR { $$ = NFT_CT_DST_IP6; } ; ct_key_dir_optional : BYTES { $$ = NFT_CT_BYTES; } |