On Sun, Jun 01, 2014 at 09:20:07PM +0100, Patrick McHardy wrote: > On Wed, May 28, 2014 at 12:08:22PM +0200, Alvaro Neira Ayuso wrote: > > From: Álvaro Neira Ayuso <alvaroneay@xxxxxxxxx> > > > > This patch fix the bug: > > > > http://bugzilla.netfilter.org/show_bug.cgi?id=924 > > > > Before, nftables doesn't permit invert ranges. This patch allows > > add rules like this: > > > > nft add rule ip test input ip daddr != 192.168.1.2-192.168.1.55 > > or > > nft add rule ip test input ip daddr == 192.168.1.2-192.168.1.55 > > > > Also, we still have the option for adding rules like this: > > > > sudo nft add rule ip test output frag id 33-45 > > > > Signed-off-by: Alvaro Neira Ayuso <alvaroneay@xxxxxxxxx> > > --- > > [changes in v2] > > * I have added OP_RANGE in netlink_gen_range. I have supposed that always > > we have a comparison before the range and I have forbidden to add rules > > with ranges without comparison symbol (== or !=). > > That seems fine. The implicit op for ranges is OP_EQ. > > The patch looks fine to me. Minor improvement might be to factor out the common > code from netlink_gen_range(), but might not be worth it. I have applied this, we can revisit this later. Thanks Alvaro and Patrick. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
