summaryrefslogtreecommitdiffstats
path: root/src/netlink_delinearize.c
diff options
context:
space:
mode:
authorArturo Borrero <arturo.borrero.glez@gmail.com>2014-03-12 19:03:19 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2014-03-13 14:16:45 +0100
commitb573748a755f5f60449b53d85fb13093461530fb (patch)
treec8f4cba80408638478fd4e0760c139855fc78482 /src/netlink_delinearize.c
parentd8118b445fa6ef44e839d9717b10dbf8d095feaa (diff)
ct: add support for setting ct mark
This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen <kristian.evensen@gmail.com>. I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'src/netlink_delinearize.c')
-rw-r--r--src/netlink_delinearize.c38
1 files changed, 35 insertions, 3 deletions
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index ca720913..62cbf0e4 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -365,9 +365,27 @@ static void netlink_parse_meta(struct netlink_parse_ctx *ctx,
netlink_parse_meta_sreg(ctx, loc, nle);
}
-static void netlink_parse_ct(struct netlink_parse_ctx *ctx,
- const struct location *loc,
- const struct nft_rule_expr *nle)
+static void netlink_parse_ct_sreg(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nft_rule_expr *nle)
+{
+ struct stmt *stmt;
+ struct expr *expr;
+
+ expr = netlink_get_register(ctx, loc,
+ nft_rule_expr_get_u32(nle,
+ NFT_EXPR_CT_SREG));
+ stmt = ct_stmt_alloc(loc,
+ nft_rule_expr_get_u32(nle, NFT_EXPR_CT_KEY),
+ expr);
+ expr_set_type(expr, stmt->ct.tmpl->dtype, stmt->ct.tmpl->byteorder);
+
+ list_add_tail(&stmt->list, &ctx->rule->stmts);
+}
+
+static void netlink_parse_ct_dreg(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nft_rule_expr *nle)
{
struct expr *expr;
@@ -377,6 +395,16 @@ static void netlink_parse_ct(struct netlink_parse_ctx *ctx,
expr);
}
+static void netlink_parse_ct(struct netlink_parse_ctx *ctx,
+ const struct location *loc,
+ const struct nft_rule_expr *nle)
+{
+ if (nft_rule_expr_is_set(nle, NFT_EXPR_CT_DREG))
+ netlink_parse_ct_dreg(ctx, loc, nle);
+ else
+ netlink_parse_ct_sreg(ctx, loc, nle);
+}
+
static void netlink_parse_counter(struct netlink_parse_ctx *ctx,
const struct location *loc,
const struct nft_rule_expr *nle)
@@ -858,6 +886,10 @@ static void rule_parse_postprocess(struct netlink_parse_ctx *ctx, struct rule *r
if (stmt->meta.expr != NULL)
expr_postprocess(&rctx, stmt, &stmt->meta.expr);
break;
+ case STMT_CT:
+ if (stmt->ct.expr != NULL)
+ expr_postprocess(&rctx, stmt, &stmt->ct.expr);
+ break;
case STMT_NAT:
if (stmt->nat.addr != NULL)
expr_postprocess(&rctx, stmt, &stmt->nat.addr);