ct: add support for setting ct mark

This patch adds the possibility to set ct keys using nft. Currently, the
connection mark is supported. This functionality enables creating rules
performing the same action as iptables -j CONNMARK --save-mark. For example:

table ip filter {
	chain postrouting {
		type filter hook postrouting priority 0;
		ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark
	}
}

My patch is based on the original http://patchwork.ozlabs.org/patch/307677/
by Kristian Evensen <kristian.evensen@gmail.com>.

I simply did a rebase and some testing. To test, I added rules like these:
 counter meta mark set 1 counter
 counter ct mark set mark counter
 counter ct mark 1 counter

The last matching worked as expected, which means the second rule is also
working as expected.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Acked-by: Kristian Evensen <kristian.evensen@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 25 insertions, 0 deletions

diff --git a/src/ct.c b/src/ct.c
index a27621e2..30639b24 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -27,6 +27,7 @@
 #include <ct.h>
 #include <gmputil.h>
 #include <utils.h>
+#include <statement.h>
 
 static const struct symbol_table ct_state_tbl = {
 	.symbols	= {
@@ -290,6 +291,30 @@ void ct_expr_update_type(struct proto_ctx *ctx, struct expr *expr)
 	}
 }
 
+static void ct_stmt_print(const struct stmt *stmt)
+{
+	printf("ct %s set ", ct_templates[stmt->ct.key].token);
+	expr_print(stmt->ct.expr);
+}
+
+static const struct stmt_ops ct_stmt_ops = {
+	.type		= STMT_CT,
+	.name		= "ct",
+	.print		= ct_stmt_print,
+};
+
+struct stmt *ct_stmt_alloc(const struct location *loc, enum nft_ct_keys key,
+			     struct expr *expr)
+{
+	struct stmt *stmt;
+
+	stmt = stmt_alloc(loc, &ct_stmt_ops);
+	stmt->ct.key	= key;
+	stmt->ct.tmpl	= &ct_templates[key];
+	stmt->ct.expr	= expr;
+	return stmt;
+}
+
 static void __init ct_init(void)
 {
 	datatype_register(&ct_state_type);