From 7f742d0a9071f932836b4f8525a6d3f7261ae083 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 21 Jun 2019 10:28:37 +0200 Subject: ct: support for NFT_CT_{SRC,DST}_{IP,IP6} These keys are available since kernel >= 4.17. You can still use NFT_CT_{SRC,DST}, however, you need to specify 'meta protocol' in first place to provide layer 3 context. Note that NFT_CT_{SRC,DST} are broken with set, maps and concatenations. This patch is implicitly fixing these cases. If your kernel is < 4.17, you can still use address matching via explicit meta nfproto: meta nfproto ipv4 ct original saddr 1.2.3.4 Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 1c0b60cf..670e91f5 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -4060,15 +4060,15 @@ rt_key : CLASSID { $$ = NFT_RT_CLASSID; } ct_expr : CT ct_key { - $$ = ct_expr_alloc(&@$, $2, -1, NFPROTO_UNSPEC); + $$ = ct_expr_alloc(&@$, $2, -1); } | CT ct_dir ct_key_dir { - $$ = ct_expr_alloc(&@$, $3, $2, NFPROTO_UNSPEC); + $$ = ct_expr_alloc(&@$, $3, $2); } - | CT ct_dir nf_key_proto ct_key_proto_field + | CT ct_dir ct_key_proto_field { - $$ = ct_expr_alloc(&@$, $4, $2, $3); + $$ = ct_expr_alloc(&@$, $3, $2); } ; @@ -4102,8 +4102,10 @@ ct_key_dir : SADDR { $$ = NFT_CT_SRC; } | ct_key_dir_optional ; -ct_key_proto_field : SADDR { $$ = NFT_CT_SRC; } - | DADDR { $$ = NFT_CT_DST; } +ct_key_proto_field : IP SADDR { $$ = NFT_CT_SRC_IP; } + | IP DADDR { $$ = NFT_CT_DST_IP; } + | IP6 SADDR { $$ = NFT_CT_SRC_IP6; } + | IP6 DADDR { $$ = NFT_CT_DST_IP6; } ; ct_key_dir_optional : BYTES { $$ = NFT_CT_BYTES; } -- cgit v1.2.3