https://bugzilla.netfilter.org/show_bug.cgi?id=950
Summary: ct status
Product: nftables
Version: unspecified
Platform: x86_64
OS/Version: All
Status: NEW
Severity: enhancement
Priority: P5
Component: nft
AssignedTo: pablo at netfilter.org
ReportedBy: anarey at gmail.com
Estimated Hours: 0.0
This is the symbol table for ct status parameter:
71 static const struct symbol_table ct_status_tbl = {
72 /*
73 * There are more, but most of them don't make sense for
filtering.
74 */
75 .symbols = {
76 SYMBOL("expected", IPS_EXPECTED),
77 SYMBOL("seen-reply", IPS_SEEN_REPLY),
78 SYMBOL("assured", IPS_ASSURED),
79 SYMBOL("confirmed", IPS_CONFIRMED),
80 SYMBOL("snat", IPS_SRC_NAT),
81 SYMBOL("dnat", IPS_DST_NAT),
82 SYMBOL("dying", IPS_DYING),
83 SYMBOL_LIST_END
84 },
85 };
We can use correctly: expected, seen-reply, assured, confirmed, dying but there
is a problem with 'snat' and 'dnat' symbol.
nft doesn't identify these symbols.
Here, an example:
$ sudo nft add rule ip test input ct status snat
<cmdline>:1:34-37: Error: syntax error, unexpected snat
add rule ip test input ct status snat
^^^^
The problem is in the parser:
Stack now 0 1 15
Error: popping token "add" (: )
Stack now 0 1
Shifting token error (: )
Entering state 3
Next token is token "snat" (: )
Error: discarding token "snat" (: )
Error: popping token error (: )
Stack now 0 1
Shifting token error (: )
Entering state 3
Reading a token: --(end of buffer or a NUL)
--EOF (start condition 0)
Now at end of input.
Cleanup: discarding lookahead token "end of file" (: )
Stack now 0 1 3
Cleanup: popping token error (: )
Cleanup: popping nterm input (: )
<cmdline>:1:34-37: Error: syntax error, unexpected snat
add rule ip test input ct status snat
## With dnat
Error: popping token "add" (: )
Stack now 0 1
Shifting token error (: )
Entering state 3
Next token is token "dnat" (: )
Error: discarding token "dnat" (: )
Error: popping token error (: )
Stack now 0 1
Shifting token error (: )
Entering state 3
Reading a token: --(end of buffer or a NUL)
--EOF (start condition 0)
Now at end of input.
Cleanup: discarding lookahead token "end of file" (: )
Stack now 0 1 3
Cleanup: popping token error (: )
Cleanup: popping nterm input (: )
<cmdline>:1:34-37: Error: syntax error, unexpected dnat
add rule ip test input ct status dnat
^^^^
--
Configure bugmail: https://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.