summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: Make invalid chain priority error more specificMáté Eckl2018-08-243-13/+22
| | | | | | | | | | | | | | | | | | | | | | | | | So far if invalid priority name was specified the error message referred to the whole chain/flowtable specification: nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ With this patch this reference is made specific to the priority specification: nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^ `prio_spec` is also reused to keep naming intuitive. The parser section formerly named `prio_spec` is renamed to `int_num` as it basically provides the mathematical set of integer numbers. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: integrate stateful expressions into sets and mapsPablo Neira Ayuso2018-08-248-24/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following example shows how to populate a set from the packet path using the destination IP address, for each entry there is a counter. The entry expires after the 1 hour timeout if no packets matching this entry are seen. table ip x { set xyz { type ipv4_addr size 65535 flags dynamic,timeout timeout 1h } chain y { type filter hook output priority filter; policy accept; update @xyz { ip daddr counter } counter } } Similar example, that creates a mapping better IP address and mark, where the mark is assigned using an incremental sequence generator from 0 to 1 inclusive. table ip x { map xyz { type ipv4_addr : mark size 65535 flags dynamic,timeout timeout 1h } chain y { type filter hook input priority filter; policy accept; update @xyz { ip saddr counter : numgen inc mod 2 } } } Supported stateful statements are: limit, quota, counter and connlimit. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: simplify map statementPablo Neira Ayuso2018-08-246-17/+49
| | | | | | | Instead of using the map expression, store dynamic key and data separately since they need special handling than constant maps. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: do not print elements in dynamically populated sets with `-s'Pablo Neira Ayuso2018-08-241-0/+5
| | | | | | | Ruleset listing with --stateless should not display the content of sets that are dynamically populated from the packet path. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* statement: incorrect spacing in set referencePablo Neira Ayuso2018-08-241-3/+3
| | | | | | | | | | | | | | | chain y { type filter hook output priority filter; policy accept; update @xyz{ ip daddr } ^^ Missing space between set reference and the element statement. This does not break restoring the ruleset but it is inconsistent to the viewer. There is also an extra space after the element statement that is enclosed in brackets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: osf: import nfnl_osf.c to load osf fingerprintsFernando Fernandez Mancera2018-08-247-1/+527
| | | | | | | | Import iptables/utils/nfnl_osf.c into nftables tree with some changes in order to load OS fingerprints automatically from pf.os file. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: make nft_mnl_talk() publicFernando Fernandez Mancera2018-08-232-1/+5
| | | | | | | | As we are going to use the function nft_mnl_talk() from the incoming nftnl_osf.c, we make it public. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* files: osf: copy iptables/utils/pf.os into nftables treeFernando Fernandez Mancera2018-08-235-2/+715
| | | | | | | | As we are going to need pf.os file to load OS fingerprints from the incoming nfnl_osf.c, we copy it into the nftables tree directory "files/osf/". Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Fix build failure in rule.cDuncan Roe2018-08-201-0/+1
| | | | | | | | | | | | | | | | | Commit c8a0e8c90 added #include <linux/netfilter_bridge.h> but that header needs the definition of IFNAMSIZ from <net/if.h> Sample build failure: CC evaluate.lo In file included from ../include/linux/netfilter_bridge.h:10:0, from rule.c:32: /usr/include/linux/if_pppox.h:42:20: error: 'IFNAMSIZ' undeclared here (not in a function) char dev[IFNAMSIZ]; /* Local device to use */ ^ Makefile:687: recipe for target 'rule.lo' failed Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add script to build PDF filesDuncan Roe2018-08-171-0/+51
| | | | | | | See comments at end of doc/build_pdfs.sh Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove PDF documentation generationPablo Neira Ayuso2018-08-176-38/+4
| | | | | | | | This adds unnecessary complexity to our build infrastructure. People can just manually generate them in PDF in case they need too. So let's keep it simple and remove this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: missing modules in cleanup pathPablo Neira Ayuso2018-08-161-3/+6
| | | | | | Update script with missing new kernel modules. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove double-spacing in textDuncan Roe2018-08-145-72/+72
| | | | | | | | Double-spacing in .txt files has no effect on PDF or man page output and can make it hard to locate phrases when editing, so remove them. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: fix 0012different_defines_0 with meta markPablo Neira Ayuso2018-08-141-1/+1
| | | | | | | Since 6dd848339444 ("src: meta: always prefix 'meta' for almost all tokens"), the unqualified meta are discouraged. Adjust test not to fail. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: reject: Allow icmpx in inet/bridge familiesPhil Sutter2018-08-147-6/+119
| | | | | | | | | | | | | | | | | | | Commit 3e6ab2b335142 added restraints on reject types for bridge and inet families but aparently those were too strict: If a rule in e.g. inet family contained a match which introduced a protocol dependency, icmpx type rejects were disallowed for no obvious reason. Allow icmpx type rejects in inet family regardless of protocol dependency since we either have IPv4 or IPv6 traffic in there and for both icmpx is fine. Merge restraints in bridge family with those for TCP reset since it already does what is needed, namely checking that ether proto is either IPv4 or IPv6. Fixes: 3e6ab2b335142 ("evaluate: reject: check in bridge and inet the network context in reject") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Set/print standard chain prios with textual namesMáté Eckl2018-08-1421-36/+333
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to use textual names to set the chain priority to standard values so that numeric values do not need to be learnt any more for basic usage. Basic arithmetic can also be done with them to ease the addition of relatively higher/lower priority chains. Addition and substraction is possible. Values are also printed with their friendly name within the range of <basicprio> +- 10. Also numeric printing is supported in case of -nnn option (numeric == NFT_NUMERIC_ALL) The supported name-value pairs and where they are valid is based on how x_tables use these values when registering their base chains. (See iptables/nft.c in the iptables repository). Also see the compatibility matrices extracted from the man page: Standard priority names, family and hook compatibility matrix ┌─────────┬───────┬────────────────┬─────────────┐ │Name │ Value │ Families │ Hooks │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │raw │ -300 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │mangle │ -150 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │dstnat │ -100 │ ip, ip6, inet │ prerouting │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │filter │ 0 │ ip, ip6, inet, │ all │ │ │ │ arp, netdev │ │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │security │ 50 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │srcnat │ 100 │ ip, ip6, inet │ postrouting │ └─────────┴───────┴────────────────┴─────────────┘ Standard priority names and hook compatibility for the bridge family ┌───────┬───────┬─────────────┐ │ │ │ │ │Name │ Value │ Hooks │ ├───────┼───────┼─────────────┤ │ │ │ │ │dstnat │ -300 │ prerouting │ ├───────┼───────┼─────────────┤ │ │ │ │ │filter │ -200 │ all │ ├───────┼───────┼─────────────┤ │ │ │ │ │out │ 100 │ output │ ├───────┼───────┼─────────────┤ │ │ │ │ │srcnat │ 300 │ postrouting │ └───────┴───────┴─────────────┘ This can be also applied for flowtables wher it works as a netdev family chain. Example: nft> add table ip x nft> add chain ip x y { type filter hook prerouting priority raw; } nft> add chain ip x z { type filter hook prerouting priority mangle + 1; } nft> add chain ip x w { type filter hook prerouting priority dstnat - 5; } nft> add chain ip x r { type filter hook prerouting priority filter + 10; } nft> add chain ip x t { type filter hook prerouting priority security; } nft> add chain ip x q { type filter hook postrouting priority srcnat + 11; } nft> add chain ip x h { type filter hook prerouting priority 15; } nft> nft> add flowtable ip x y { hook ingress priority filter + 5 ; devices = {enp0s31f6}; } nft> nft> add table arp x nft> add chain arp x y { type filter hook input priority filter + 5; } nft> nft> add table bridge x nft> add chain bridge x y { type filter hook input priority filter + 9; } nft> add chain bridge x z { type filter hook prerouting priority dstnat; } nft> add chain bridge x q { type filter hook postrouting priority srcnat; } nft> add chain bridge x k { type filter hook output priority out; } nft> nft> list ruleset table ip x { flowtable y { hook ingress priority filter + 5 devices = { enp0s31f6 } } chain y { type filter hook prerouting priority raw; policy accept; } chain z { type filter hook prerouting priority mangle + 1; policy accept; } chain w { type filter hook prerouting priority dstnat - 5; policy accept; } chain r { type filter hook prerouting priority filter + 10; policy accept; } chain t { type filter hook prerouting priority security; policy accept; } chain q { type filter hook postrouting priority 111; policy accept; } chain h { type filter hook prerouting priority 15; policy accept; } } table arp x { chain y { type filter hook input priority filter + 5; policy accept; } } table bridge x { chain y { type filter hook input priority filter + 9; policy accept; } chain z { type filter hook prerouting priority dstnat; policy accept; } chain q { type filter hook postrouting priority srcnat; policy accept; } chain k { type filter hook output priority out; policy accept; } } nft> # Everything should fail after this nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain ip x q { type filter hook prerouting priority srcnat + 11; } Error: 'srcnat' is invalid priority in this context. add chain ip x q { type filter hook prerouting priority srcnat + 11; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain arp x y { type filter hook input priority raw; } Error: 'raw' is invalid priority in this context. add chain arp x y { type filter hook input priority raw; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } Error: 'magle' is invalid priority. add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x r { type filter hook postrouting priority dstnat; } Error: 'dstnat' is invalid priority in this context. add chain bridge x r { type filter hook postrouting priority dstnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x t { type filter hook prerouting priority srcnat; } Error: 'srcnat' is invalid priority in this context. add chain bridge x t { type filter hook prerouting priority srcnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: doc: fix make distcheckArushi Singhal2018-08-141-4/+4
| | | | | | | fix make distcheck for conversion to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: doc: fix typos in asciidocArushi Singhal2018-08-144-8/+8
| | | | | | | Correct all the typos done while converting man page source to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: validate too deep jumpstack from basechainPablo Neira Ayuso2018-08-081-1/+3
| | | | | | | | | | | If there is no basechain, the validation is never exercised. Too deep nested chains are fine as long as they are not connected to a basechain. Update test to add a basechain so we exercise validation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: user nigglesDuncan Roe2018-08-072-4/+4
| | | | | | | | | | | | | - data-types.txt: "user space" -> userspace to match usage in statements.txt & data-types.txt - nft.txt: "an user-defined" sounds odd to a native English speaker (trust me) so change to "a user-defined" These patches are applied on top of Máté's previous 2, but apply fine without them (2 occurrences of "offset -5 lines"). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add comment possibility to man pageMáté Eckl2018-08-071-2/+7
| | | | | | | | | | | Commenting is really useful in complex rulesets, however it is not documented that they can be added to any rule. This patch adds commenting possibility to the man page. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix syntax for RULESMáté Eckl2018-08-071-1/+1
| | | | | | | | | [] means optional but 'add' or 'insert' is not optional one of them is required which is usually signed with {} braces. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: test osf with setsPablo Neira Ayuso2018-08-072-0/+9
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow to use new osf expression from assignment statementPablo Neira Ayuso2018-08-073-0/+11
| | | | | | | | | | So the following rule to set the conntrack mark based on the OS passive recognition works: # nft add rule x y ct mark set osf name map { "Windows" : 1, "MacOs" : 2 } Fixes: 9f28b685b473 ("src: introduce passive OS fingerprint matching") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: improve test cases for osfFernando Fernandez Mancera2018-08-072-2/+15
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: use NFT_OSF_MAXGENRELEN instead of IFNAMSIZ in osf.cFernando Fernandez Mancera2018-08-072-3/+2
| | | | | | | | As no "genre" in pf.os exceed 16 bytes of length, we reduce NFT_OSF_MAXGENRELEN parameter to 16 bytes and use it instead of IFNAMSIZ. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Changes following detailed comparison with last XML versionDuncan Roe2018-08-065-41/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These were found by a combination of tkdiff and side-by-side man pages Most changes preserve or (occasionally) fix highlighting, casing or plurality. No major omissions were found. - data-types.txt: (Nothing special) - nft.txt: -- changed "`nft' stands for Netfilter" back to "`nf' stands for Netfilter" -- removed mysterious plus sign - payload-expression.txt: -- XML had MTU as 16-bit so changed back from 32. Is that correct? - primary-expression.txt: (Nothing special) - statements.txt: (Nothing special) This patch does not address any of the following observations: 1. Title has changed from nft to NFT 2. There is no attempt at justification. 3. There is no attempt at hyphenation. 4. Long lines of code now wrap instead of indenting nicely. See e.g. "tcp option" line under EXTENSION HEADER EXPRESSIONS 5. Tables have a lot of empty lines in them. 6. Occasionally there is severe wrapping, e.g. under CHAINS see add/create/delete/&c. which wrap at about cc40. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Miscellaneous spelling fixesDuncan Roe2018-08-056-12/+21
| | | | | | | | | | | | | | | | | These were found by ispell -p ./ispell_nft *.txt in nftables/doc. - ispell.nft: Added some new words - nft.txt: (nothing special) - payload-expression.txt: lengthbits and offsetbits were run together before the conversion to .txt, but the conversion lost the underlining - primary-expression.txt: ispell suggested rtclassid instead of rtlclassid, which agres with previous usage - stateful-objects.txt: (nothing special) - statements.txt: nonbase chains changed back to non-base chains as it used to be Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: resolve run-together IPv6 address specification headersDuncan Roe2018-08-041-2/+6
| | | | | | | | | | This run-together header has been there since before the conversion to .txt. Also the comment starting "without []" wrapped around in an 80cc xterm, so split into 2 comment lines and fixed grammar (extrs "the"). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove UTF8(?) sequencesDuncan Roe2018-08-041-11/+11
| | | | | | | | | | | | | | | | There were some forced hyphenations which only ever looked right in an 80-column terminal and now don't all look right even there e.g. searched for included files. This op- tion may be specified Also the URL on the last line a"http://creativecommons.org/licenses/by-sa/4.0/a(C) Tested using man in the C locale Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* test: py: fix osf testcases warningFernando Fernandez Mancera2018-08-042-3/+3
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add missing osf.hPablo Neira Ayuso2018-08-042-0/+7
| | | | | | And update Makefile.am accordingly. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add osf expression to man pageFernando Fernandez Mancera2018-08-041-0/+29
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add test cases for "osf" matchingFernando Fernandez Mancera2018-08-042-0/+10
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: introduce passive OS fingerprint matchingFernando Fernandez Mancera2018-08-049-0/+99
| | | | | | | | | | | | | | Add support for "osf" expression. Example: table ip foo { chain bar { type filter hook input priority 0; policy accept; osf name "Linux" counter packets 3 bytes 132 } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: correct some typos in asciidocArushi Singhal2018-08-036-39/+29
| | | | | | | | Correct some typo mistakes done while converting man page source to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Expose socket mark via socket expressionMáté Eckl2018-08-039-9/+73
| | | | | | | | This can be used like ct mark or meta mark except it cannot be set. doc and tests are included. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add tproxy statement to man pageMáté Eckl2018-08-031-0/+58
| | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com>
* tests: py: Add test cases for tproxy supportMáté Eckl2018-08-036-0/+153
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Add tproxy supportMáté Eckl2018-08-038-0/+294
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for transparent proxy functionality which is supported in ip, ip6 and inet tables. The syntax is the following: tproxy [{|ip|ip6}] to {<ip address>|:<port>|<ip address>:<port>} It looks for a socket listening on the specified address or port and assigns it to the matching packet. In an inet table, a packet matches for both families until address is specified. Network protocol family has to be specified **only** in inet tables if address is specified. As transparent proxy support is implemented for sockets with layer 4 information, a transport protocol header criterion has to be set in the same rule. eg. 'meta l4proto tcp' or 'udp dport 4444' Example ruleset: table ip x { chain y { type filter hook prerouting priority -150; policy accept; tcp dport ntp tproxy to 1.1.1.1 udp dport ssh tproxy to :2222 } } table ip6 x { chain y { type filter hook prerouting priority -150; policy accept; tcp dport ntp tproxy to [dead::beef] udp dport ssh tproxy to :2222 } } table inet x { chain y { type filter hook prerouting priority -150; policy accept; tcp dport 321 tproxy to :ssh tcp dport 99 tproxy ip to 1.1.1.1:999 udp dport 155 tproxy ip6 to [dead::beef]:smux } } Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: statements.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-25/+83
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: stateful-objects.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-2/+7
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: primary-expression.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-3/+13
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: payload-expression.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-3/+21
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: data-types.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-7/+22
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: nft.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-51/+183
| | | | | | | | | | | | | | | When I tried to send a patch that included man page update I got the following error from git send-email: fatal: patch.patch:287: patch contains a line longer than 998 characters Line 287 was a non-modified line so it was there before my patch. Even this patch can only be sent with mutt but not with git send-email. This patch tries to fix this issue by wrapping extra long lines to 80 characters wide. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: remove nft.xml from CLEANFILESFlorian Westphal2018-07-261-1/+1
| | | | | | | This file doesn't exist. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: doc: Convert man page source to asciidocArushi Singhal2018-07-269-5743/+2435
| | | | | | | This patch converts nft.xml into asciidoc markup. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: fix a typo in socket.hFernando Fernandez Mancera2018-07-221-3/+1
| | | | | | | Fix a typo in socket_template struct description. Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: meta: always prefix 'meta' for almost all tokensFlorian Westphal2018-07-2119-117/+114
| | | | | | | | | | | | | | | | | | got following bug report: nft add ... ct mark set mark and 0x10 ... always sets 0. What reporter meant to write instead was 'ct mark', not 'mark'. We can't just remove support for 'mark' and force 'meta mark', but we can start to discourage it by printing meta prefix too. Later on, we could start to print deprecation warning if needed. Followup patch can also change "iifname" etc. to "meta iifname". Signed-off-by: Florian Westphal <fw@strlen.de>