@@ -458,6 +458,7 @@ enum nft_exthdr_attributes {
* @NFT_META_NFTRACE: packet nftrace bit
* @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
* @NFT_META_SECMARK: packet secmark (skb->secmark)
+ * @NFT_META_CONNMARK: used to get/set the connection mark
*/
enum nft_meta_keys {
NFT_META_LEN,
@@ -475,6 +476,7 @@ enum nft_meta_keys {
NFT_META_NFTRACE,
NFT_META_RTCLASSID,
NFT_META_SECMARK,
+ NFT_META_CONNMARK,
};
/**
@@ -656,7 +656,7 @@ static struct error_record *mark_type_parse(const struct expr *sym,
const struct datatype mark_type = {
.type = TYPE_MARK,
.name = "mark",
- .desc = "packet mark",
+ .desc = "packet/connection mark",
.size = 4 * BITS_PER_BYTE,
.byteorder = BYTEORDER_HOST_ENDIAN,
.basetype = &integer_type,
@@ -329,6 +329,8 @@ static const struct meta_template meta_templates[] = {
4 * 8, BYTEORDER_HOST_ENDIAN),
[NFT_META_SECMARK] = META_TEMPLATE("secmark", &integer_type,
4 * 8, BYTEORDER_HOST_ENDIAN),
+ [NFT_META_CONNMARK] = META_TEMPLATE("connmark", &mark_type,
+ 4 * 8, BYTEORDER_HOST_ENDIAN),
};
static void meta_expr_print(const struct expr *expr)
@@ -291,6 +291,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
%token NFTRACE "nftrace"
%token RTCLASSID "rtclassid"
%token SECMARK "secmark"
+%token CONNMARK "connmark"
%token CT "ct"
%token DIRECTION "direction"
@@ -1387,6 +1388,7 @@ meta_key : LENGTH { $$ = NFT_META_LEN; }
| NFTRACE { $$ = NFT_META_NFTRACE; }
| RTCLASSID { $$ = NFT_META_RTCLASSID; }
| SECMARK { $$ = NFT_META_SECMARK; }
+ | CONNMARK { $$ = NFT_META_CONNMARK; }
;
meta_stmt : META meta_key SET expr
@@ -381,6 +381,7 @@ addrstring ({macaddr}|{ip4addr}|{ip6addr})
"nftrace" { return NFTRACE; }
"rtclassid" { return RTCLASSID; }
"secmark" { return SECMARK; }
+"connmark" { return CONNMARK; }
"ct" { return CT; }
"direction" { return DIRECTION; }