From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Westphal Subject: [PATCH nft 8/9] doc: ct zone set support Date: Tue, 14 Mar 2017 20:58:15 +0100 Message-ID: <20170314195816.1721-9-fw@strlen.de> References: <20170314195816.1721-1-fw@strlen.de> Cc: Florian Westphal To: Return-path: Received: from Chamillionaire.breakpoint.cc ([146.0.238.67]:42158 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751229AbdCNT6c (ORCPT ); Tue, 14 Mar 2017 15:58:32 -0400 In-Reply-To: <20170314195816.1721-1-fw@strlen.de> Sender: netfilter-devel-owner@vger.kernel.org List-ID: Signed-off-by: Florian Westphal --- doc/nft.xml | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/doc/nft.xml b/doc/nft.xml index de86d2a18258..8ea280417742 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -3347,6 +3347,7 @@ ip6 filter output log flags all mark label + zone set value @@ -3354,10 +3355,14 @@ ip6 filter output log flags all The ct statement sets meta data associated with a connection. + The zone id has to be assigned before a conntrack lookup takes place, + i.e. this has to be done in prerouting and possibly output (if locally + generated packets need to be placed in a distinct zone), with a hook + priority of -300. - Meta statement types + Conntrack statement types @@ -3380,6 +3385,12 @@ ip6 filter output log flags all Connection tracking label label + + zone + conntrack zone + integer (16 bit) + +
@@ -3391,6 +3402,21 @@ ip6 filter output log flags all ct set mark meta mark + + set zone mapped via interface + +table inet raw { + chain prerouting { + type filter hook prerouting priority -300; + ct zone set iif map { "eth1" : 1, "veth1" : 2 } + } + chain output { + type filter hook output priority -300; + ct zone set oif map { "eth1" : 1, "veth1" : 2 } + } +} + + -- 2.10.2