On Wed, Mar 12, 2014 at 07:03:19PM +0100, Arturo Borrero Gonzalez wrote:
> This patch adds the possibility to set ct keys using nft. Currently, the
> connection mark is supported. This functionality enables creating rules
> performing the same action as iptables -j CONNMARK --save-mark. For example:
>
> table ip filter {
> chain postrouting {
> type filter hook postrouting priority 0;
> ip protocol icmp ip daddr 8.8.8.8 ct mark set meta mark
> }
> }
>
> My patch is based on the original http://patchwork.ozlabs.org/patch/307677/
> by Kristian Evensen <kristian.evensen@xxxxxxxxx>.
>
> I simply did a rebase and some testing. To test, I added rules like these:
> counter meta mark set 1 counter
> counter ct mark set mark counter
> counter ct mark 1 counter
>
> The last matching worked as expected, which means the second rule is also
> working as expected.
Applied, thanks for recovering this patch Arturo!
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
