From patchwork Tue Mar 14 19:58:14 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Westphal X-Patchwork-Id: 738911 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3vjQXQ1DLZz9s1h for ; Wed, 15 Mar 2017 06:58:30 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751448AbdCNT6a (ORCPT ); Tue, 14 Mar 2017 15:58:30 -0400 Received: from Chamillionaire.breakpoint.cc ([146.0.238.67]:42154 "EHLO Chamillionaire.breakpoint.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751229AbdCNT63 (ORCPT ); Tue, 14 Mar 2017 15:58:29 -0400 Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.84_2) (envelope-from ) id 1cnsa4-0000pC-Rd; Tue, 14 Mar 2017 20:58:05 +0100 From: Florian Westphal To: Cc: Florian Westphal Subject: [PATCH nft 7/9] files: provide 'raw' table equivalent Date: Tue, 14 Mar 2017 20:58:14 +0100 Message-Id: <20170314195816.1721-8-fw@strlen.de> X-Mailer: git-send-email 2.10.2 In-Reply-To: <20170314195816.1721-1-fw@strlen.de> References: <20170314195816.1721-1-fw@strlen.de> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org useful for the 'ct zone set' statement, it has to be done before the conntrack lookup but preferrably after the defragmention hook. In iptables, the functionality resides in the CT target which is restricted to the raw table. This provides the skeleton for nft. Signed-off-by: Florian Westphal --- files/nftables/Makefile.am | 4 +++- files/nftables/ipv4-raw | 6 ++++++ files/nftables/ipv6-raw | 6 ++++++ 3 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 files/nftables/ipv4-raw create mode 100644 files/nftables/ipv6-raw diff --git a/files/nftables/Makefile.am b/files/nftables/Makefile.am index 1378e2b684f1..a4c7ac7c980b 100644 --- a/files/nftables/Makefile.am +++ b/files/nftables/Makefile.am @@ -5,9 +5,11 @@ dist_pkgsysconf_DATA = bridge-filter \ ipv4-filter \ ipv4-mangle \ ipv4-nat \ + ipv4-raw \ ipv6-filter \ ipv6-mangle \ - ipv6-nat + ipv6-nat \ + ipv6-raw install-data-hook: ${SED} -i 's|@sbindir[@]|${sbindir}/|g' ${DESTDIR}${pkgsysconfdir}/* diff --git a/files/nftables/ipv4-raw b/files/nftables/ipv4-raw new file mode 100644 index 000000000000..19773ee8bc3b --- /dev/null +++ b/files/nftables/ipv4-raw @@ -0,0 +1,6 @@ +#! @sbindir@nft -f + +table raw { + chain prerouting { type filter hook prerouting priority -300; } + chain output { type filter hook output priority -300; } +} diff --git a/files/nftables/ipv6-raw b/files/nftables/ipv6-raw new file mode 100644 index 000000000000..5ee56a83987e --- /dev/null +++ b/files/nftables/ipv6-raw @@ -0,0 +1,6 @@ +#! @sbindir@nft -f + +table ip6 raw { + chain prerouting { type filter hook prerouting priority -300; } + chain output { type filter hook output priority -300; } +}