[PATCH xtables] nft: decode meta l4proto

[Florian Westphal]

Allow to show '-p tcp' in case rule was added by nft (which prefers
use of meta l4proto).

Signed-off-by: Florian Westphal <f...@strlen.de>
---
 iptables/nft-ipv4.c | 10 ++++++++++
 iptables/nft-ipv6.c | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
index 0cfe84e11b2d..eaf861d1f76e 100644
--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
@@ -172,6 +172,16 @@ static void nft_ipv4_parse_meta(struct nft_xt_ctx *ctx, 
struct nftnl_expr *e,
 {
        struct iptables_command_state *cs = data;
 
+       switch (ctx->meta.key) {
+       case NFT_META_L4PROTO:
+               cs->fw.ip.proto = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA);
+               if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
+                       cs->fw.ip.invflags |= XT_INV_PROTO;
+               return;
+       default:
+               break;
+       }
+
        parse_meta(e, ctx->meta.key, cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
                   cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
                   &cs->fw.ip.invflags);
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
index a33d4573b4df..5315aba647be 100644
--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
@@ -115,6 +115,16 @@ static void nft_ipv6_parse_meta(struct nft_xt_ctx *ctx, 
struct nftnl_expr *e,
 {
        struct iptables_command_state *cs = data;
 
+       switch (ctx->meta.key) {
+       case NFT_META_L4PROTO:
+               cs->fw6.ipv6.proto = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA);
+               if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
+                       cs->fw6.ipv6.invflags |= XT_INV_PROTO;
+               return;
+       default:
+               break;
+       }
+
        parse_meta(e, ctx->meta.key, cs->fw6.ipv6.iniface,
                   cs->fw6.ipv6.iniface_mask, cs->fw6.ipv6.outiface,
                   cs->fw6.ipv6.outiface_mask, &cs->fw6.ipv6.invflags);
-- 
2.16.4

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html