summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: Review libnftables-json.adocPhil Sutter2018-08-301-101/+87
| | | | | | | | | | | | | Drop the bits for TABLE from synopsis section - adding the remaining objects there as well is tedious and tends to become unreadable. Instead assume that readers will find the objects' descriptions in their sections. Also fix JSON syntax in many objects: The properties are enclosed in an object, of course. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Improve example in libnftables-json(5)Phil Sutter2018-08-301-3/+26
| | | | | | | | | | | | | The introductory example was a bit flawed in that the third command ('list ruleset') wouldn't yield expected results due to all three commands ending in a single transaction and therefore the changes of the first two commands were not committed yet at the time ruleset was listed. Instead demonstrate adding a chain and a rule to the new table. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: shell: Test cases for standard prios for flowtablesMáté Eckl2018-08-302-0/+38
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: shell: Test cases for standard chain priosMáté Eckl2018-08-3010-0/+1759
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Document implicit dependency creation for icmp/icmpv6Phil Sutter2018-08-301-0/+10
| | | | | | | | | As suggested at NFWS, the implicit nfproto dependencies generated by icmp/icmpv6 header field matches should be documented along with how to achieve matching on unusual packets. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: Fix coloring of differencesPhil Sutter2018-08-301-17/+14
| | | | | | | This was surprisingly hard to get right, but this should do the trick. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: build: run make on each ./configure optionPablo Neira Ayuso2018-08-301-1/+2
| | | | | | | Not only ./configure, but make sure compilation does not break for each option. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: build: run make distcheck from fresh clonePablo Neira Ayuso2018-08-301-5/+14
| | | | | | Just for sanity reasons. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: tproxy: add json supportFlorian Westphal2018-08-297-0/+345
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: tproxy: relax family restrictionsFlorian Westphal2018-08-295-32/+33
| | | | | | | | | | | | | | | | | | evaluation step currently prohibits tproxy ip to 1.2.3.4 in ip family, and tproxy ip6 to dead::1 in ip6. This seems an arbitrary limitation, just accept this. The current restriction would make json output support harder than needed, as the tproxy expression generated from json path would have to special-case the table its currently in, rather than just using the family attribute in the json output. We obviously still reject the family in case it mismatches the table family (e.g., can't use ip address in ip6 table). Signed-off-by: Florian Westphal <fw@strlen.de>
* src: osf: add json supportFlorian Westphal2018-08-295-1/+91
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* parser: avoid nf_key_proto redefinitionsFlorian Westphal2018-08-291-14/+4
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: build: no need for root to run build testsPablo Neira Ayuso2018-08-291-5/+0
| | | | | | Plain user is just fine. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Fix compile errorPhil Sutter2018-08-291-4/+1
| | | | | | | | | | | | | | | | Commit 9e45a28ca467f ("src: honor /etc/services") broke compiling with JSON support enabled: inet_service_type_print() is not suited for converting inet_service datatype into JSON at all. In order to avoid having to replicate the port value resolving into human-readable name in inet_service_type_json(), just return a numeric value. At least for JSON output, this probably makes most sense either way since the output is expected to be parsed by scripts which have an easier time with numers than names anyway. Fixes: 9e45a28ca467f ("src: honor /etc/services") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: honor /etc/servicesPablo Neira Ayuso2018-08-245-361/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This partial patch reverts: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") f0f99006d34b ("datatype: Replace getaddrinfo() by internal lookup table") so /etc/services is used to interpret service names, eg. # nft add rule x y tcp dport \"ssh\" Then, listing looks like: # nft list ruleset -l table x { chain y { ... tcp dport "ssh" } } Major changes with regards to the original approach are: 1) Services are displayed in text via `-l' option. 2) Services are user-defined, just like mappings in /etc/iproute2/* files and connlabel.conf, so they are displayed enclosed in quotes. Note that original service name code was broken since it parses both udp and tcp service names but it only displays tcp services names as literal. This is because NI_DGRAM is missing. This patch makes nft falls back on udp services if no literal was found in the initial tcp service name query. Proper way to handle would be to add infrastructure to store protocol context information in struct output_ctx. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Make invalid chain priority error more specificMáté Eckl2018-08-243-13/+22
| | | | | | | | | | | | | | | | | | | | | | | | | So far if invalid priority name was specified the error message referred to the whole chain/flowtable specification: nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ With this patch this reference is made specific to the priority specification: nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^ `prio_spec` is also reused to keep naming intuitive. The parser section formerly named `prio_spec` is renamed to `int_num` as it basically provides the mathematical set of integer numbers. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: integrate stateful expressions into sets and mapsPablo Neira Ayuso2018-08-248-24/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following example shows how to populate a set from the packet path using the destination IP address, for each entry there is a counter. The entry expires after the 1 hour timeout if no packets matching this entry are seen. table ip x { set xyz { type ipv4_addr size 65535 flags dynamic,timeout timeout 1h } chain y { type filter hook output priority filter; policy accept; update @xyz { ip daddr counter } counter } } Similar example, that creates a mapping better IP address and mark, where the mark is assigned using an incremental sequence generator from 0 to 1 inclusive. table ip x { map xyz { type ipv4_addr : mark size 65535 flags dynamic,timeout timeout 1h } chain y { type filter hook input priority filter; policy accept; update @xyz { ip saddr counter : numgen inc mod 2 } } } Supported stateful statements are: limit, quota, counter and connlimit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify map statementPablo Neira Ayuso2018-08-246-17/+49
| | | | | | | Instead of using the map expression, store dynamic key and data separately since they need special handling than constant maps. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: do not print elements in dynamically populated sets with `-s'Pablo Neira Ayuso2018-08-241-0/+5
| | | | | | | Ruleset listing with --stateless should not display the content of sets that are dynamically populated from the packet path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: incorrect spacing in set referencePablo Neira Ayuso2018-08-241-3/+3
| | | | | | | | | | | | | | | chain y { type filter hook output priority filter; policy accept; update @xyz{ ip daddr } ^^ Missing space between set reference and the element statement. This does not break restoring the ruleset but it is inconsistent to the viewer. There is also an extra space after the element statement that is enclosed in brackets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: osf: import nfnl_osf.c to load osf fingerprintsFernando Fernandez Mancera2018-08-247-1/+527
| | | | | | | | Import iptables/utils/nfnl_osf.c into nftables tree with some changes in order to load OS fingerprints automatically from pf.os file. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: make nft_mnl_talk() publicFernando Fernandez Mancera2018-08-232-1/+5
| | | | | | | | As we are going to use the function nft_mnl_talk() from the incoming nftnl_osf.c, we make it public. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: osf: copy iptables/utils/pf.os into nftables treeFernando Fernandez Mancera2018-08-235-2/+715
| | | | | | | | As we are going to need pf.os file to load OS fingerprints from the incoming nfnl_osf.c, we copy it into the nftables tree directory "files/osf/". Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Fix build failure in rule.cDuncan Roe2018-08-201-0/+1
| | | | | | | | | | | | | | | | | Commit c8a0e8c90 added #include <linux/netfilter_bridge.h> but that header needs the definition of IFNAMSIZ from <net/if.h> Sample build failure: CC evaluate.lo In file included from ../include/linux/netfilter_bridge.h:10:0, from rule.c:32: /usr/include/linux/if_pppox.h:42:20: error: 'IFNAMSIZ' undeclared here (not in a function) char dev[IFNAMSIZ]; /* Local device to use */ ^ Makefile:687: recipe for target 'rule.lo' failed Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add script to build PDF filesDuncan Roe2018-08-171-0/+51
| | | | | | | See comments at end of doc/build_pdfs.sh Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove PDF documentation generationPablo Neira Ayuso2018-08-176-38/+4
| | | | | | | | This adds unnecessary complexity to our build infrastructure. People can just manually generate them in PDF in case they need too. So let's keep it simple and remove this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: missing modules in cleanup pathPablo Neira Ayuso2018-08-161-3/+6
| | | | | | Update script with missing new kernel modules. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove double-spacing in textDuncan Roe2018-08-145-72/+72
| | | | | | | | Double-spacing in .txt files has no effect on PDF or man page output and can make it hard to locate phrases when editing, so remove them. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: fix 0012different_defines_0 with meta markPablo Neira Ayuso2018-08-141-1/+1
| | | | | | | Since 6dd848339444 ("src: meta: always prefix 'meta' for almost all tokens"), the unqualified meta are discouraged. Adjust test not to fail. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: Allow icmpx in inet/bridge familiesPhil Sutter2018-08-147-6/+119
| | | | | | | | | | | | | | | | | | | Commit 3e6ab2b335142 added restraints on reject types for bridge and inet families but aparently those were too strict: If a rule in e.g. inet family contained a match which introduced a protocol dependency, icmpx type rejects were disallowed for no obvious reason. Allow icmpx type rejects in inet family regardless of protocol dependency since we either have IPv4 or IPv6 traffic in there and for both icmpx is fine. Merge restraints in bridge family with those for TCP reset since it already does what is needed, namely checking that ether proto is either IPv4 or IPv6. Fixes: 3e6ab2b335142 ("evaluate: reject: check in bridge and inet the network context in reject") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Set/print standard chain prios with textual namesMáté Eckl2018-08-1421-36/+333
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to use textual names to set the chain priority to standard values so that numeric values do not need to be learnt any more for basic usage. Basic arithmetic can also be done with them to ease the addition of relatively higher/lower priority chains. Addition and substraction is possible. Values are also printed with their friendly name within the range of <basicprio> +- 10. Also numeric printing is supported in case of -nnn option (numeric == NFT_NUMERIC_ALL) The supported name-value pairs and where they are valid is based on how x_tables use these values when registering their base chains. (See iptables/nft.c in the iptables repository). Also see the compatibility matrices extracted from the man page: Standard priority names, family and hook compatibility matrix ┌─────────┬───────┬────────────────┬─────────────┐ │Name │ Value │ Families │ Hooks │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │raw │ -300 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │mangle │ -150 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │dstnat │ -100 │ ip, ip6, inet │ prerouting │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │filter │ 0 │ ip, ip6, inet, │ all │ │ │ │ arp, netdev │ │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │security │ 50 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │srcnat │ 100 │ ip, ip6, inet │ postrouting │ └─────────┴───────┴────────────────┴─────────────┘ Standard priority names and hook compatibility for the bridge family ┌───────┬───────┬─────────────┐ │ │ │ │ │Name │ Value │ Hooks │ ├───────┼───────┼─────────────┤ │ │ │ │ │dstnat │ -300 │ prerouting │ ├───────┼───────┼─────────────┤ │ │ │ │ │filter │ -200 │ all │ ├───────┼───────┼─────────────┤ │ │ │ │ │out │ 100 │ output │ ├───────┼───────┼─────────────┤ │ │ │ │ │srcnat │ 300 │ postrouting │ └───────┴───────┴─────────────┘ This can be also applied for flowtables wher it works as a netdev family chain. Example: nft> add table ip x nft> add chain ip x y { type filter hook prerouting priority raw; } nft> add chain ip x z { type filter hook prerouting priority mangle + 1; } nft> add chain ip x w { type filter hook prerouting priority dstnat - 5; } nft> add chain ip x r { type filter hook prerouting priority filter + 10; } nft> add chain ip x t { type filter hook prerouting priority security; } nft> add chain ip x q { type filter hook postrouting priority srcnat + 11; } nft> add chain ip x h { type filter hook prerouting priority 15; } nft> nft> add flowtable ip x y { hook ingress priority filter + 5 ; devices = {enp0s31f6}; } nft> nft> add table arp x nft> add chain arp x y { type filter hook input priority filter + 5; } nft> nft> add table bridge x nft> add chain bridge x y { type filter hook input priority filter + 9; } nft> add chain bridge x z { type filter hook prerouting priority dstnat; } nft> add chain bridge x q { type filter hook postrouting priority srcnat; } nft> add chain bridge x k { type filter hook output priority out; } nft> nft> list ruleset table ip x { flowtable y { hook ingress priority filter + 5 devices = { enp0s31f6 } } chain y { type filter hook prerouting priority raw; policy accept; } chain z { type filter hook prerouting priority mangle + 1; policy accept; } chain w { type filter hook prerouting priority dstnat - 5; policy accept; } chain r { type filter hook prerouting priority filter + 10; policy accept; } chain t { type filter hook prerouting priority security; policy accept; } chain q { type filter hook postrouting priority 111; policy accept; } chain h { type filter hook prerouting priority 15; policy accept; } } table arp x { chain y { type filter hook input priority filter + 5; policy accept; } } table bridge x { chain y { type filter hook input priority filter + 9; policy accept; } chain z { type filter hook prerouting priority dstnat; policy accept; } chain q { type filter hook postrouting priority srcnat; policy accept; } chain k { type filter hook output priority out; policy accept; } } nft> # Everything should fail after this nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain ip x q { type filter hook prerouting priority srcnat + 11; } Error: 'srcnat' is invalid priority in this context. add chain ip x q { type filter hook prerouting priority srcnat + 11; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain arp x y { type filter hook input priority raw; } Error: 'raw' is invalid priority in this context. add chain arp x y { type filter hook input priority raw; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } Error: 'magle' is invalid priority. add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x r { type filter hook postrouting priority dstnat; } Error: 'dstnat' is invalid priority in this context. add chain bridge x r { type filter hook postrouting priority dstnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x t { type filter hook prerouting priority srcnat; } Error: 'srcnat' is invalid priority in this context. add chain bridge x t { type filter hook prerouting priority srcnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: doc: fix make distcheckArushi Singhal2018-08-141-4/+4
| | | | | | | fix make distcheck for conversion to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: doc: fix typos in asciidocArushi Singhal2018-08-144-8/+8
| | | | | | | Correct all the typos done while converting man page source to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: validate too deep jumpstack from basechainPablo Neira Ayuso2018-08-081-1/+3
| | | | | | | | | | | If there is no basechain, the validation is never exercised. Too deep nested chains are fine as long as they are not connected to a basechain. Update test to add a basechain so we exercise validation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: user nigglesDuncan Roe2018-08-072-4/+4
| | | | | | | | | | | | | - data-types.txt: "user space" -> userspace to match usage in statements.txt & data-types.txt - nft.txt: "an user-defined" sounds odd to a native English speaker (trust me) so change to "a user-defined" These patches are applied on top of Máté's previous 2, but apply fine without them (2 occurrences of "offset -5 lines"). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add comment possibility to man pageMáté Eckl2018-08-071-2/+7
| | | | | | | | | | | Commenting is really useful in complex rulesets, however it is not documented that they can be added to any rule. This patch adds commenting possibility to the man page. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix syntax for RULESMáté Eckl2018-08-071-1/+1
| | | | | | | | | [] means optional but 'add' or 'insert' is not optional one of them is required which is usually signed with {} braces. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: test osf with setsPablo Neira Ayuso2018-08-072-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow to use new osf expression from assignment statementPablo Neira Ayuso2018-08-073-0/+11
| | | | | | | | | | So the following rule to set the conntrack mark based on the OS passive recognition works: # nft add rule x y ct mark set osf name map { "Windows" : 1, "MacOs" : 2 } Fixes: 9f28b685b473 ("src: introduce passive OS fingerprint matching") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: improve test cases for osfFernando Fernandez Mancera2018-08-072-2/+15
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use NFT_OSF_MAXGENRELEN instead of IFNAMSIZ in osf.cFernando Fernandez Mancera2018-08-072-3/+2
| | | | | | | | As no "genre" in pf.os exceed 16 bytes of length, we reduce NFT_OSF_MAXGENRELEN parameter to 16 bytes and use it instead of IFNAMSIZ. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Changes following detailed comparison with last XML versionDuncan Roe2018-08-065-41/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These were found by a combination of tkdiff and side-by-side man pages Most changes preserve or (occasionally) fix highlighting, casing or plurality. No major omissions were found. - data-types.txt: (Nothing special) - nft.txt: -- changed "`nft' stands for Netfilter" back to "`nf' stands for Netfilter" -- removed mysterious plus sign - payload-expression.txt: -- XML had MTU as 16-bit so changed back from 32. Is that correct? - primary-expression.txt: (Nothing special) - statements.txt: (Nothing special) This patch does not address any of the following observations: 1. Title has changed from nft to NFT 2. There is no attempt at justification. 3. There is no attempt at hyphenation. 4. Long lines of code now wrap instead of indenting nicely. See e.g. "tcp option" line under EXTENSION HEADER EXPRESSIONS 5. Tables have a lot of empty lines in them. 6. Occasionally there is severe wrapping, e.g. under CHAINS see add/create/delete/&c. which wrap at about cc40. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Miscellaneous spelling fixesDuncan Roe2018-08-056-12/+21
| | | | | | | | | | | | | | | | | These were found by ispell -p ./ispell_nft *.txt in nftables/doc. - ispell.nft: Added some new words - nft.txt: (nothing special) - payload-expression.txt: lengthbits and offsetbits were run together before the conversion to .txt, but the conversion lost the underlining - primary-expression.txt: ispell suggested rtclassid instead of rtlclassid, which agres with previous usage - stateful-objects.txt: (nothing special) - statements.txt: nonbase chains changed back to non-base chains as it used to be Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: resolve run-together IPv6 address specification headersDuncan Roe2018-08-041-2/+6
| | | | | | | | | | This run-together header has been there since before the conversion to .txt. Also the comment starting "without []" wrapped around in an 80cc xterm, so split into 2 comment lines and fixed grammar (extrs "the"). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove UTF8(?) sequencesDuncan Roe2018-08-041-11/+11
| | | | | | | | | | | | | | | | There were some forced hyphenations which only ever looked right in an 80-column terminal and now don't all look right even there e.g. searched for included files. This op- tion may be specified Also the URL on the last line a"http://creativecommons.org/licenses/by-sa/4.0/a(C) Tested using man in the C locale Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: py: fix osf testcases warningFernando Fernandez Mancera2018-08-042-3/+3
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add missing osf.hPablo Neira Ayuso2018-08-042-0/+7
| | | | | | And update Makefile.am accordingly. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add osf expression to man pageFernando Fernandez Mancera2018-08-041-0/+29
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add test cases for "osf" matchingFernando Fernandez Mancera2018-08-042-0/+10
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce passive OS fingerprint matchingFernando Fernandez Mancera2018-08-049-0/+99
| | | | | | | | | | | | | | Add support for "osf" expression. Example: table ip foo { chain bar { type filter hook input priority 0; policy accept; osf name "Linux" counter packets 3 bytes 132 } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>