From e6c32b2fa0b820bc81cbb99e8ed601eabbbfac69 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Mon, 1 Feb 2021 22:21:41 +0100 Subject: src: add negation match on singleton bitmask value This patch provides a shortcut for: ct status and dnat == 0 which allows to check for the packet whose dnat bit is unset: # nft add rule x y ct status ! dnat counter This operation is only available for expression with a bitmask basetype, eg. # nft describe ct status ct expression, datatype ct_status (conntrack status) (basetype bitmask, integer), 32 bits Signed-off-by: Pablo Neira Ayuso --- src/parser_bison.y | 1 + 1 file changed, 1 insertion(+) (limited to 'src/parser_bison.y') diff --git a/src/parser_bison.y b/src/parser_bison.y index 519e8efe..11e899ff 100644 --- a/src/parser_bison.y +++ b/src/parser_bison.y @@ -4639,6 +4639,7 @@ relational_op : EQ { $$ = OP_EQ; } | GT { $$ = OP_GT; } | GTE { $$ = OP_GTE; } | LTE { $$ = OP_LTE; } + | NOT { $$ = OP_NEG; } ; verdict_expr : ACCEPT -- cgit v1.2.3