Re: [nftables PATCH v2] netlink: Allow to invert the ranges

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Jun 01, 2014 at 09:20:07PM +0100, Patrick McHardy wrote:
> On Wed, May 28, 2014 at 12:08:22PM +0200, Alvaro Neira Ayuso wrote:
> > From: Álvaro Neira Ayuso <alvaroneay@gmail.com>
> > 
> > This patch fix the bug:
> > 
> > http://bugzilla.netfilter.org/show_bug.cgi?id=924
> > 
> > Before, nftables doesn't permit invert ranges. This patch allows
> > add rules like this:
> > 
> > nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55
> > or
> > nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55
> > 
> > Also, we still have the option for adding rules like this:
> > 
> > sudo nft add rule ip test output frag id 33-45
> > 
> > Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com>
> > ---
> > [changes in v2]
> > * I have added OP_RANGE in netlink_gen_range. I have supposed that always
> >   we have a comparison before the range and I have forbidden to add rules
> >   with ranges without comparison symbol (== or !=).
> 
> That seems fine. The implicit op for ranges is OP_EQ.
> 
> The patch looks fine to me. Minor improvement might be to factor out the common
> code from netlink_gen_range(), but might not be worth it.

I have applied this, we can revisit this later. Thanks Alvaro and
Patrick.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html