From bc9d2e5006b2963f9cc117076ecf38a5c3782964 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 11 May 2016 00:22:11 +0200 Subject: src: add ecn support This supports both IPv4: # nft --debug=netlink add rule ip filter forward ip ecn ce counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000003 ] [ counter pkts 0 bytes 0 ] For IPv6: # nft --debug=netlink add rule ip6 filter forward ip6 ecn ce counter ip6 filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000030 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000030 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso --- src/scanner.l | 1 + 1 file changed, 1 insertion(+) (limited to 'src/scanner.l') diff --git a/src/scanner.l b/src/scanner.l index 275beaa1..e8b216ef 100644 --- a/src/scanner.l +++ b/src/scanner.l @@ -363,6 +363,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr}) "version" { return HDRVERSION; } "hdrlength" { return HDRLENGTH; } "dscp" { return DSCP; } +"ecn" { return ECN; } "length" { return LENGTH; } "frag-off" { return FRAG_OFF; } "ttl" { return TTL; } -- cgit v1.2.3