This patch changes the parser to permit both nat_flags and port specification
in the redirect expression.
The resulting syntax is:
% nft add rule nat prerouting redirect [port] [nat_flags]
The port specification requires a bit of context regardin the transport
protocol. Some examples:
% nft add rule nat prerouting tcp dport 22 redirect :23
% nft add rule add prerouting udp dport 53 redirect :5353
The nat_flags argument is the last argument:
% nft add rule nat prerouting tdp dport 80 redirect :8080 random
The port specification can be a range:
% nft add rule nat prerouting tcp dport 80 redirect :8080-8090 random
While at it, the regression tests files are updated.
Suggested-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@xxxxxxxxx>
---
src/parser.y | 5 +++++
tests/regression/ip/redirect.t | 14 +++++++++-----
tests/regression/ip6/redirect.t | 8 +++++---
3 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/src/parser.y b/src/parser.y
index 6209e9e..3992c6a 100644
--- a/src/parser.y
+++ b/src/parser.y
@@ -1437,6 +1437,11 @@ redir_stmt_arg : COLON expr
{
$<stmt>0->redir.flags = $1;
}
+ | COLON expr nf_nat_flags
+ {
+ $<stmt>0->redir.proto = $2;
+ $<stmt>0->redir.flags = $3;
+ }
;
nf_nat_flags : nf_nat_flag
diff --git a/tests/regression/ip/redirect.t b/tests/regression/ip/redirect.t
index f69fd07..cb230e2 100644
--- a/tests/regression/ip/redirect.t
+++ b/tests/regression/ip/redirect.t
@@ -24,11 +24,15 @@ tcp dport 39128 redirect :993;ok
redirect :1234;fail
redirect :12341111;fail
-# invalid arguments
-tcp dport 9128 redirect :993 random;fail
-tcp dport 9128 redirect :993 random-fully;fail
-tcp dport 9128 redirect persistent :123;fail
-tcp dport 9128 redirect random,persistent :123;fail
+# both port and nf_nat flags
+tcp dport 9128 redirect :993 random;ok
+tcp dport 9128 redirect :993 random-fully;ok
+tcp dport 9128 redirect :123 persistent;ok
+tcp dport 9128 redirect :123 random,persistent;ok
+
+# nf_nat flags is the last argument
+udp dport 1234 redirect random :123;fail
+udp dport 21234 redirect persistent,random-fully :431;fail
# redirect is a terminal statement
tcp dport 22 redirect counter packets 0 bytes 0 accept;fail
diff --git a/tests/regression/ip6/redirect.t b/tests/regression/ip6/redirect.t
index d972871..dce4794 100644
--- a/tests/regression/ip6/redirect.t
+++ b/tests/regression/ip6/redirect.t
@@ -25,9 +25,11 @@ tcp dport 39128 redirect :993;ok
redirect :1234;fail
redirect :12341111;fail
-# invalid arguments
-tcp dport 9128 redirect :993 random;fail
-tcp dport 9128 redirect :993 random-fully;fail
+# both port and nf_nat flags
+tcp dport 9128 redirect :993 random;ok
+tcp dport 9128 redirect :993 random-fully,persistent;ok
+
+# nf_nat flags are the last argument
tcp dport 9128 redirect persistent :123;fail
tcp dport 9128 redirect random,persistent :123;fail
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
