diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-02-01 22:21:41 +0100 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-02-05 13:38:20 +0100 |
commit | e6c32b2fa0b820bc81cbb99e8ed601eabbbfac69 (patch) | |
tree | 47e56d582bde34804b3913716a6c7745faa3c582 /include/expression.h | |
parent | 0c189656148d834b17aa9d98b0b11018bc9d2465 (diff) |
src: add negation match on singleton bitmask value
This patch provides a shortcut for:
ct status and dnat == 0
which allows to check for the packet whose dnat bit is unset:
# nft add rule x y ct status ! dnat counter
This operation is only available for expression with a bitmask basetype, eg.
# nft describe ct status
ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/expression.h')
-rw-r--r-- | include/expression.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/expression.h b/include/expression.h index 718dac5a..2d07f3d9 100644 --- a/include/expression.h +++ b/include/expression.h @@ -93,6 +93,7 @@ enum ops { OP_GT, OP_LTE, OP_GTE, + OP_NEG, __OP_MAX }; #define OP_MAX (__OP_MAX - 1) |