From acdfae9c3126ff8716c93713f13e8e31a85d5e95 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 17 Mar 2015 16:36:15 +0100 Subject: src: allow to specify the default policy for base chains The new syntax is: nft add chain filter input { hook input type filter priority 0\; policy accept\; } but the previous syntax is still allowed: nft add chain filter input { hook input type filter priority 0\; } this assumes default policy to accept. If the base chain already exists, you can update the policy via: nft add chain filter input { policy drop\; } Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 6fc834d0..ea3ff526 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -913,6 +913,7 @@ chain_block : /* empty */ { $$ = $-1; } | chain_block common_block | chain_block stmt_seperator | chain_block hook_spec stmt_seperator + | chain_block policy_spec stmt_seperator | chain_block rule stmt_seperator { list_add_tail(&$2->list, &$1->rules); @@ -1070,6 +1071,26 @@ hook_spec : TYPE STRING HOOK STRING PRIORITY NUM } ; +policy_spec : POLICY ACCEPT + { + if ($0->policy != -1) { + erec_queue(error(&@$, "you cannot set chain policy twice"), + state->msgs); + YYERROR; + } + $0->policy = NF_ACCEPT; + } + | POLICY DROP + { + if ($0->policy != -1) { + erec_queue(error(&@$, "you cannot set chain policy twice"), + state->msgs); + YYERROR; + } + $0->policy = NF_DROP; + } + ; + identifier : STRING ; -- cgit v1.2.3