From e6c32b2fa0b820bc81cbb99e8ed601eabbbfac69 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 1 Feb 2021 22:21:41 +0100 Subject: src: add negation match on singleton bitmask value This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso --- include/expression.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include') diff --git a/include/expression.h b/include/expression.h index 718dac5a..2d07f3d9 100644 --- a/include/expression.h +++ b/include/expression.h @@ -93,6 +93,7 @@ enum ops { OP_GT, OP_LTE, OP_GTE, + OP_NEG, __OP_MAX }; #define OP_MAX (__OP_MAX - 1) -- cgit v1.2.3