From 6ea7579e6fe249e1775e871985be555e22d48778 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Thu, 19 Jul 2018 23:20:20 +0200 Subject: nft: decode meta l4proto Allow to show '-p tcp' in case rule was added by nft (which prefers use of meta l4proto). Signed-off-by: Florian Westphal --- iptables/nft-ipv6.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'iptables/nft-ipv6.c') diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c index a33d4573..5315aba6 100644 --- a/iptables/nft-ipv6.c +++ b/iptables/nft-ipv6.c @@ -115,6 +115,16 @@ static void nft_ipv6_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e, { struct iptables_command_state *cs = data; + switch (ctx->meta.key) { + case NFT_META_L4PROTO: + cs->fw6.ipv6.proto = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA); + if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ) + cs->fw6.ipv6.invflags |= XT_INV_PROTO; + return; + default: + break; + } + parse_meta(e, ctx->meta.key, cs->fw6.ipv6.iniface, cs->fw6.ipv6.iniface_mask, cs->fw6.ipv6.outiface, cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags); -- cgit v1.2.3