From b573748a755f5f60449b53d85fb13093461530fb Mon Sep 17 00:00:00 2001 From: Arturo Borrero Date: Wed, 12 Mar 2014 19:03:19 +0100 Subject: ct: add support for setting ct mark This patch adds the possibility to set ct keys using nft. Currently, the connection mark is supported. This functionality enables creating rules performing the same action as iptables -j CONNMARK --save-mark. For example: table ip filter { chain postrouting { type filter hook postrouting priority 0; ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark } } My patch is based on the original http://patchwork.ozlabs.org/patch/307677/ by Kristian Evensen . I simply did a rebase and some testing. To test, I added rules like these: counter meta mark set 1 counter counter ct mark set mark counter counter ct mark 1 counter The last matching worked as expected, which means the second rule is also working as expected. Signed-off-by: Arturo Borrero Gonzalez Acked-by: Kristian Evensen Signed-off-by: Pablo Neira Ayuso --- include/statement.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'include/statement.h') diff --git a/include/statement.h b/include/statement.h index 14a66df6..896b972d 100644 --- a/include/statement.h +++ b/include/statement.h @@ -67,6 +67,17 @@ struct queue_stmt { extern struct stmt *queue_stmt_alloc(const struct location *loc); +#include +struct ct_stmt { + enum nft_ct_keys key; + const struct ct_template *tmpl; + struct expr *expr; +}; + +extern struct stmt *ct_stmt_alloc(const struct location *loc, + enum nft_ct_keys key, + struct expr *expr); + /** * enum stmt_types - statement types * @@ -80,6 +91,7 @@ extern struct stmt *queue_stmt_alloc(const struct location *loc); * @STMT_REJECT: REJECT statement * @STMT_NAT: NAT statement * @STMT_QUEUE: QUEUE statement + * @STMT_CT: conntrack statement */ enum stmt_types { STMT_INVALID, @@ -92,6 +104,7 @@ enum stmt_types { STMT_REJECT, STMT_NAT, STMT_QUEUE, + STMT_CT, }; /** @@ -138,6 +151,7 @@ struct stmt { struct reject_stmt reject; struct nat_stmt nat; struct queue_stmt queue; + struct ct_stmt ct; }; }; -- cgit v1.2.3