From: Florian Westphal <fw@strlen.de>
To: <netfilter-devel@vger.kernel.org>
Cc: Florian Westphal <fw@strlen.de>
Subject: [PATCH nft 7/9] files: provide 'raw' table equivalent
Date: Tue, 14 Mar 2017 20:58:14 +0100 [thread overview]
Message-ID: <20170314195816.1721-8-fw@strlen.de> (raw)
In-Reply-To: <20170314195816.1721-1-fw@strlen.de>
useful for the 'ct zone set' statement, it has to be done before
the conntrack lookup but preferrably after the defragmention hook.
In iptables, the functionality resides in the CT target which is
restricted to the raw table. This provides the skeleton for nft.
Signed-off-by: Florian Westphal <fw@strlen.de>
---
files/nftables/Makefile.am | 4 +++-
files/nftables/ipv4-raw | 6 ++++++
files/nftables/ipv6-raw | 6 ++++++
3 files changed, 15 insertions(+), 1 deletion(-)
create mode 100644 files/nftables/ipv4-raw
create mode 100644 files/nftables/ipv6-raw
diff --git a/files/nftables/Makefile.am b/files/nftables/Makefile.am
index 1378e2b684f1..a4c7ac7c980b 100644
--- a/files/nftables/Makefile.am
+++ b/files/nftables/Makefile.am
@@ -5,9 +5,11 @@ dist_pkgsysconf_DATA = bridge-filter \
ipv4-filter \
ipv4-mangle \
ipv4-nat \
+ ipv4-raw \
ipv6-filter \
ipv6-mangle \
- ipv6-nat
+ ipv6-nat \
+ ipv6-raw
install-data-hook:
${SED} -i 's|@sbindir[@]|${sbindir}/|g' ${DESTDIR}${pkgsysconfdir}/*
diff --git a/files/nftables/ipv4-raw b/files/nftables/ipv4-raw
new file mode 100644
index 000000000000..19773ee8bc3b
--- /dev/null
+++ b/files/nftables/ipv4-raw
@@ -0,0 +1,6 @@
+#! @sbindir@nft -f
+
+table raw {
+ chain prerouting { type filter hook prerouting priority -300; }
+ chain output { type filter hook output priority -300; }
+}
diff --git a/files/nftables/ipv6-raw b/files/nftables/ipv6-raw
new file mode 100644
index 000000000000..5ee56a83987e
--- /dev/null
+++ b/files/nftables/ipv6-raw
@@ -0,0 +1,6 @@
+#! @sbindir@nft -f
+
+table ip6 raw {
+ chain prerouting { type filter hook prerouting priority -300; }
+ chain output { type filter hook output priority -300; }
+}
--
2.10.2
next prev parent reply other threads:[~2017-03-14 19:58 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-14 19:58 [PATCH nft 0/9] ct helper set support Florian Westphal
2017-03-14 19:58 ` [PATCH nft 1/9] src: add initial ct helper support Florian Westphal
2017-03-14 19:58 ` [PATCH nft 2/9] evaluate: refactor CMD_OBJ_QUOTA/COUNTER handling Florian Westphal
2017-03-14 19:58 ` [PATCH nft 3/9] src: allow listing all ct helpers Florian Westphal
2017-03-14 19:58 ` [PATCH nft 4/9] src: implement add/create/delete for ct helper objects Florian Westphal
2017-03-14 19:58 ` [PATCH nft 5/9] ct: add conntrack event mask support Florian Westphal
2017-03-14 20:00 ` Florian Westphal
2017-03-15 9:53 ` Pablo Neira Ayuso
2017-03-14 19:58 ` [PATCH nft 6/9] tests: py: add ct helper tests Florian Westphal
2017-03-15 10:39 ` Pablo Neira Ayuso
2017-03-15 11:46 ` Florian Westphal
2017-03-14 19:58 ` Florian Westphal [this message]
2017-03-14 19:58 ` [PATCH nft 8/9] doc: ct zone set support Florian Westphal
2017-03-14 19:58 ` [PATCH nft 9/9] doc: helper assignement Florian Westphal
2017-03-15 10:40 ` Pablo Neira Ayuso
2017-03-15 10:35 ` [PATCH nft 0/9] ct helper set support Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170314195816.1721-8-fw@strlen.de \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).