path: root/src/parser_bison.y
diff options
authorBalazs Scheidler <>2020-08-29 09:04:01 +0200
committerPablo Neira Ayuso <>2020-08-29 13:16:46 +0200
commit945ac0677a6c73f31ec4ae21e89923570f8cb15a (patch)
treef2b86193bf8df9abe788f88afb9717a72ec892d4 /src/parser_bison.y
parentc156232a530b30b6668712eda22bc491b0900283 (diff)
socket: add support for "wildcard" key
iptables had a "-m socket --transparent" which didn't match sockets that are bound to all addresses (e.g. for ipv4, and ::0 for ipv6). It was possible to override this behavior by using --nowildcard, in which case it did match zero bound sockets as well. The issue is that nftables never included the wildcard check, so in effect it behaved like "iptables -m socket --transparent --nowildcard" with no means to exclude wildcarded listeners. This is a problem as a user-space process that binds to<port> that enables IP_TRANSPARENT would effectively intercept traffic going in _any_ direction on the specific port, whereas in most cases, transparent proxies would only need this for one specific address. The solution is to add "socket wildcard" key to the nft_socket module, which makes it possible to match on the wildcardness of a socket from one's ruleset. This is how to use it: table inet haproxy { chain prerouting { type filter hook prerouting priority -150; policy accept; socket transparent 1 socket wildcard 0 mark set 0x00000001 } } This patch effectively depends on its counterpart in the kernel. Signed-off-by: Balazs Scheidler <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'src/parser_bison.y')
1 files changed, 2 insertions, 0 deletions
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 95adc48f..d938f566 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -213,6 +213,7 @@ int nft_lex(void *, void *, void *);
%token SOCKET "socket"
%token TRANSPARENT "transparent"
+%token WILDCARD "wildcard"
%token TPROXY "tproxy"
@@ -4595,6 +4596,7 @@ socket_expr : SOCKET socket_key
offset_opt : /* empty */ { $$ = 0; }