From a84921d7c0de950632ab4630dd4f7ad763e9e453 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 14 Nov 2016 22:19:07 +0100
Subject: src: add notrack support

This patch adds the notrack statement, to skip connection tracking for
certain packets.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/ct.c                  | 16 ++++++++++++++++
 src/evaluate.c            |  1 +
 src/netlink_delinearize.c |  8 ++++++++
 src/netlink_linearize.c   | 11 +++++++++++
 src/parser_bison.y        |  6 ++++++
 src/scanner.l             |  2 ++
 6 files changed, 44 insertions(+)

(limited to 'src')

diff --git a/src/ct.c b/src/ct.c
index 81918764..e5327539 100644
--- a/src/ct.c
+++ b/src/ct.c
@@ -414,6 +414,22 @@ struct stmt *ct_stmt_alloc(const struct location *loc, enum nft_ct_keys key,
 	return stmt;
 }
 
+static void notrack_stmt_print(const struct stmt *stmt)
+{
+	printf("notrack");
+}
+
+static const struct stmt_ops notrack_stmt_ops = {
+	.type		= STMT_NOTRACK,
+	.name		= "notrack",
+	.print		= notrack_stmt_print,
+};
+
+struct stmt *notrack_stmt_alloc(const struct location *loc)
+{
+	return stmt_alloc(loc, &notrack_stmt_ops);
+}
+
 static void __init ct_init(void)
 {
 	datatype_register(&ct_state_type);
diff --git a/src/evaluate.c b/src/evaluate.c
index 878efacd..c60e0f11 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -2478,6 +2478,7 @@ int stmt_evaluate(struct eval_ctx *ctx, struct stmt *stmt)
 	case STMT_COUNTER:
 	case STMT_LIMIT:
 	case STMT_QUOTA:
+	case STMT_NOTRACK:
 		return 0;
 	case STMT_EXPRESSION:
 		return stmt_evaluate_expr(ctx, stmt);
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 434089b7..66d38caa 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -635,6 +635,13 @@ static void netlink_parse_numgen(struct netlink_parse_ctx *ctx,
 	netlink_set_register(ctx, dreg, expr);
 }
 
+static void netlink_parse_notrack(struct netlink_parse_ctx *ctx,
+				  const struct location *loc,
+				  const struct nftnl_expr *nle)
+{
+	ctx->stmt = notrack_stmt_alloc(loc);
+}
+
 static void netlink_parse_ct_stmt(struct netlink_parse_ctx *ctx,
 				  const struct location *loc,
 				  const struct nftnl_expr *nle)
@@ -1127,6 +1134,7 @@ static const struct {
 	{ .name = "range",	.parse = netlink_parse_range },
 	{ .name = "reject",	.parse = netlink_parse_reject },
 	{ .name = "nat",	.parse = netlink_parse_nat },
+	{ .name = "notrack",	.parse = netlink_parse_notrack },
 	{ .name = "masq",	.parse = netlink_parse_masq },
 	{ .name = "redir",	.parse = netlink_parse_redir },
 	{ .name = "dup",	.parse = netlink_parse_dup },
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
index 6c0f39bf..2bee6844 100644
--- a/src/netlink_linearize.c
+++ b/src/netlink_linearize.c
@@ -1095,6 +1095,15 @@ static void netlink_gen_ct_stmt(struct netlink_linearize_ctx *ctx,
 	nftnl_rule_add_expr(ctx->nlr, nle);
 }
 
+static void netlink_gen_notrack_stmt(struct netlink_linearize_ctx *ctx,
+				     const struct stmt *stmt)
+{
+	struct nftnl_expr *nle;
+
+	nle = alloc_nft_expr("notrack");
+	nftnl_rule_add_expr(ctx->nlr, nle);
+}
+
 static void netlink_gen_set_stmt(struct netlink_linearize_ctx *ctx,
 				 const struct stmt *stmt)
 {
@@ -1190,6 +1199,8 @@ static void netlink_gen_stmt(struct netlink_linearize_ctx *ctx,
 		nle = netlink_gen_stmt_stateful(ctx, stmt);
 		nftnl_rule_add_expr(ctx->nlr, nle);
 		break;
+	case STMT_NOTRACK:
+		return netlink_gen_notrack_stmt(ctx, stmt);
 	default:
 		BUG("unknown statement type %s\n", stmt->ops->name);
 	}
diff --git a/src/parser_bison.y b/src/parser_bison.y
index 74f24a52..91955c18 100644
--- a/src/parser_bison.y
+++ b/src/parser_bison.y
@@ -425,6 +425,8 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %token XML			"xml"
 %token JSON			"json"
 
+%token NOTRACK			"notrack"
+
 %type <string>			identifier type_identifier string comment_spec
 %destructor { xfree($$); }	identifier type_identifier string comment_spec
 
@@ -2564,6 +2566,10 @@ meta_stmt		:	META	meta_key	SET	expr
 
 				$$ = meta_stmt_alloc(&@$, key, $4);
 			}
+			|	NOTRACK
+			{
+				$$ = notrack_stmt_alloc(&@$);
+			}
 			;
 
 offset_opt		:	/* empty */	{ $$ = 0; }
diff --git a/src/scanner.l b/src/scanner.l
index 9cb8d778..cd7398b4 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -467,6 +467,8 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 
 "fib"			{ return FIB; }
 
+"notrack"		{ return NOTRACK; }
+
 "xml"			{ return XML; }
 "json"			{ return JSON; }
 
-- 
cgit v1.2.3