nftables: add support for the "inet" family

Add support for the mixed IPv4/IPv6 "inet" family. This mainly consist
of adding the "inet" <-> NFPROTO_INET mapping in the parser and netlink
support functions.

Additionally add the definitions for the inet filter table.

Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/src/evaluate.c b/src/evaluate.c
index 257c67edf6fddc97ad9380329bbf2bdebd10136c..4ca329434793a3680b684a998676c73d63e85955 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1273,6 +1273,7 @@ static uint32_t str2hooknum(uint32_t family, const char *hook)
        case NFPROTO_IPV4:
        case NFPROTO_BRIDGE:
        case NFPROTO_IPV6:
+       case NFPROTO_INET:
                /* These families have overlapping values for each hook */
                if (!strcmp(hook, "prerouting"))
                        return NF_INET_PRE_ROUTING;

diff --git a/src/parser.y b/src/parser.y
index 7778d504e795fa8299e8da03340138e3de34c027..190733378b4db81359c35b25d897ab2cface5993 100644 (file)
--- a/src/parser.y
+++ b/src/parser.y
@@ -166,6 +166,8 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %token MAP                     "map"
 %token HANDLE                  "handle"
 
+%token INET                    "inet"
+
 %token ADD                     "add"
 %token INSERT                  "insert"
 %token DELETE                  "delete"
@@ -827,6 +829,7 @@ string                      :       STRING
 family_spec            :       /* empty */     { $$ = NFPROTO_IPV4; }
                        |       IP              { $$ = NFPROTO_IPV4; }
                        |       IP6             { $$ = NFPROTO_IPV6; }
+                       |       INET            { $$ = NFPROTO_INET; }
                        |       ARP             { $$ = NFPROTO_ARP; }
                        |       BRIDGE          { $$ = NFPROTO_BRIDGE; }
                        ;

diff --git a/src/rule.c b/src/rule.c
index ec8b6a48763bda8892190ea76df041b506d97f49..a16c2de7f9a28fd3cd539b97a674c064b37aebc7 100644 (file)
--- a/src/rule.c
+++ b/src/rule.c
@@ -276,6 +276,8 @@ static const char *family2str(unsigned int family)
                        return "ip";
                case NFPROTO_IPV6:
                        return "ip6";
+               case NFPROTO_INET:
+                       return "inet";
                case NFPROTO_ARP:
                        return "arp";
                case NFPROTO_BRIDGE:
@@ -292,6 +294,7 @@ static const char *hooknum2str(unsigned int family, unsigned int hooknum)
        case NFPROTO_IPV4:
        case NFPROTO_BRIDGE:
        case NFPROTO_IPV6:
+       case NFPROTO_INET:
                switch (hooknum) {
                case NF_INET_PRE_ROUTING:
                        return "prerouting";

diff --git a/src/scanner.l b/src/scanner.l
index 8c4f25d2a303e460ef6ab236181184ddbdbec6a2..f075f820c138c54085d39d2d635367b595ce68b2 100644 (file)
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -235,6 +235,8 @@ addrstring  ({macaddr}|{ip4addr}|{ip6addr})
 "goto"                 { return GOTO; }
 "return"               { return RETURN; }
 
+"inet"                 { return INET; }
+
 "add"                  { return ADD; }
 "insert"               { return INSERT; }
 "delete"               { return DELETE; }