summaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* doc: Review libnftables-json.adocPhil Sutter2018-08-301-101/+87
| | | | | | | | | | | | | Drop the bits for TABLE from synopsis section - adding the remaining objects there as well is tedious and tends to become unreadable. Instead assume that readers will find the objects' descriptions in their sections. Also fix JSON syntax in many objects: The properties are enclosed in an object, of course. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Improve example in libnftables-json(5)Phil Sutter2018-08-301-3/+26
| | | | | | | | | | | | | The introductory example was a bit flawed in that the third command ('list ruleset') wouldn't yield expected results due to all three commands ending in a single transaction and therefore the changes of the first two commands were not committed yet at the time ruleset was listed. Instead demonstrate adding a chain and a rule to the new table. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Document implicit dependency creation for icmp/icmpv6Phil Sutter2018-08-301-0/+10
| | | | | | | | | As suggested at NFWS, the implicit nfproto dependencies generated by icmp/icmpv6 header field matches should be documented along with how to achieve matching on unusual packets. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add script to build PDF filesDuncan Roe2018-08-171-0/+51
| | | | | | | See comments at end of doc/build_pdfs.sh Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove PDF documentation generationPablo Neira Ayuso2018-08-172-18/+3
| | | | | | | | This adds unnecessary complexity to our build infrastructure. People can just manually generate them in PDF in case they need too. So let's keep it simple and remove this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove double-spacing in textDuncan Roe2018-08-145-72/+72
| | | | | | | | Double-spacing in .txt files has no effect on PDF or man page output and can make it hard to locate phrases when editing, so remove them. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Set/print standard chain prios with textual namesMáté Eckl2018-08-141-7/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds the possibility to use textual names to set the chain priority to standard values so that numeric values do not need to be learnt any more for basic usage. Basic arithmetic can also be done with them to ease the addition of relatively higher/lower priority chains. Addition and substraction is possible. Values are also printed with their friendly name within the range of <basicprio> +- 10. Also numeric printing is supported in case of -nnn option (numeric == NFT_NUMERIC_ALL) The supported name-value pairs and where they are valid is based on how x_tables use these values when registering their base chains. (See iptables/nft.c in the iptables repository). Also see the compatibility matrices extracted from the man page: Standard priority names, family and hook compatibility matrix ┌─────────┬───────┬────────────────┬─────────────┐ │Name │ Value │ Families │ Hooks │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │raw │ -300 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │mangle │ -150 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │dstnat │ -100 │ ip, ip6, inet │ prerouting │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │filter │ 0 │ ip, ip6, inet, │ all │ │ │ │ arp, netdev │ │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │security │ 50 │ ip, ip6, inet │ all │ ├─────────┼───────┼────────────────┼─────────────┤ │ │ │ │ │ │srcnat │ 100 │ ip, ip6, inet │ postrouting │ └─────────┴───────┴────────────────┴─────────────┘ Standard priority names and hook compatibility for the bridge family ┌───────┬───────┬─────────────┐ │ │ │ │ │Name │ Value │ Hooks │ ├───────┼───────┼─────────────┤ │ │ │ │ │dstnat │ -300 │ prerouting │ ├───────┼───────┼─────────────┤ │ │ │ │ │filter │ -200 │ all │ ├───────┼───────┼─────────────┤ │ │ │ │ │out │ 100 │ output │ ├───────┼───────┼─────────────┤ │ │ │ │ │srcnat │ 300 │ postrouting │ └───────┴───────┴─────────────┘ This can be also applied for flowtables wher it works as a netdev family chain. Example: nft> add table ip x nft> add chain ip x y { type filter hook prerouting priority raw; } nft> add chain ip x z { type filter hook prerouting priority mangle + 1; } nft> add chain ip x w { type filter hook prerouting priority dstnat - 5; } nft> add chain ip x r { type filter hook prerouting priority filter + 10; } nft> add chain ip x t { type filter hook prerouting priority security; } nft> add chain ip x q { type filter hook postrouting priority srcnat + 11; } nft> add chain ip x h { type filter hook prerouting priority 15; } nft> nft> add flowtable ip x y { hook ingress priority filter + 5 ; devices = {enp0s31f6}; } nft> nft> add table arp x nft> add chain arp x y { type filter hook input priority filter + 5; } nft> nft> add table bridge x nft> add chain bridge x y { type filter hook input priority filter + 9; } nft> add chain bridge x z { type filter hook prerouting priority dstnat; } nft> add chain bridge x q { type filter hook postrouting priority srcnat; } nft> add chain bridge x k { type filter hook output priority out; } nft> nft> list ruleset table ip x { flowtable y { hook ingress priority filter + 5 devices = { enp0s31f6 } } chain y { type filter hook prerouting priority raw; policy accept; } chain z { type filter hook prerouting priority mangle + 1; policy accept; } chain w { type filter hook prerouting priority dstnat - 5; policy accept; } chain r { type filter hook prerouting priority filter + 10; policy accept; } chain t { type filter hook prerouting priority security; policy accept; } chain q { type filter hook postrouting priority 111; policy accept; } chain h { type filter hook prerouting priority 15; policy accept; } } table arp x { chain y { type filter hook input priority filter + 5; policy accept; } } table bridge x { chain y { type filter hook input priority filter + 9; policy accept; } chain z { type filter hook prerouting priority dstnat; policy accept; } chain q { type filter hook postrouting priority srcnat; policy accept; } chain k { type filter hook output priority out; policy accept; } } nft> # Everything should fail after this nft> add chain ip x h { type filter hook prerouting priority first; } Error: 'first' is invalid priority in this context. add chain ip x h { type filter hook prerouting priority first; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain ip x q { type filter hook prerouting priority srcnat + 11; } Error: 'srcnat' is invalid priority in this context. add chain ip x q { type filter hook prerouting priority srcnat + 11; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain arp x y { type filter hook input priority raw; } Error: 'raw' is invalid priority in this context. add chain arp x y { type filter hook input priority raw; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } Error: 'magle' is invalid priority. add flowtable ip x y { hook ingress priority magle; devices = {enp0s31f6}; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x r { type filter hook postrouting priority dstnat; } Error: 'dstnat' is invalid priority in this context. add chain bridge x r { type filter hook postrouting priority dstnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ nft> add chain bridge x t { type filter hook prerouting priority srcnat; } Error: 'srcnat' is invalid priority in this context. add chain bridge x t { type filter hook prerouting priority srcnat; } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: doc: fix make distcheckArushi Singhal2018-08-141-4/+4
| | | | | | | fix make distcheck for conversion to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: doc: fix typos in asciidocArushi Singhal2018-08-144-8/+8
| | | | | | | Correct all the typos done while converting man page source to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: user nigglesDuncan Roe2018-08-072-4/+4
| | | | | | | | | | | | | - data-types.txt: "user space" -> userspace to match usage in statements.txt & data-types.txt - nft.txt: "an user-defined" sounds odd to a native English speaker (trust me) so change to "a user-defined" These patches are applied on top of Máté's previous 2, but apply fine without them (2 occurrences of "offset -5 lines"). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add comment possibility to man pageMáté Eckl2018-08-071-2/+7
| | | | | | | | | | | Commenting is really useful in complex rulesets, however it is not documented that they can be added to any rule. This patch adds commenting possibility to the man page. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix syntax for RULESMáté Eckl2018-08-071-1/+1
| | | | | | | | | [] means optional but 'add' or 'insert' is not optional one of them is required which is usually signed with {} braces. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Changes following detailed comparison with last XML versionDuncan Roe2018-08-065-41/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These were found by a combination of tkdiff and side-by-side man pages Most changes preserve or (occasionally) fix highlighting, casing or plurality. No major omissions were found. - data-types.txt: (Nothing special) - nft.txt: -- changed "`nft' stands for Netfilter" back to "`nf' stands for Netfilter" -- removed mysterious plus sign - payload-expression.txt: -- XML had MTU as 16-bit so changed back from 32. Is that correct? - primary-expression.txt: (Nothing special) - statements.txt: (Nothing special) This patch does not address any of the following observations: 1. Title has changed from nft to NFT 2. There is no attempt at justification. 3. There is no attempt at hyphenation. 4. Long lines of code now wrap instead of indenting nicely. See e.g. "tcp option" line under EXTENSION HEADER EXPRESSIONS 5. Tables have a lot of empty lines in them. 6. Occasionally there is severe wrapping, e.g. under CHAINS see add/create/delete/&c. which wrap at about cc40. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Miscellaneous spelling fixesDuncan Roe2018-08-056-12/+21
| | | | | | | | | | | | | | | | | These were found by ispell -p ./ispell_nft *.txt in nftables/doc. - ispell.nft: Added some new words - nft.txt: (nothing special) - payload-expression.txt: lengthbits and offsetbits were run together before the conversion to .txt, but the conversion lost the underlining - primary-expression.txt: ispell suggested rtclassid instead of rtlclassid, which agres with previous usage - stateful-objects.txt: (nothing special) - statements.txt: nonbase chains changed back to non-base chains as it used to be Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: resolve run-together IPv6 address specification headersDuncan Roe2018-08-041-2/+6
| | | | | | | | | | This run-together header has been there since before the conversion to .txt. Also the comment starting "without []" wrapped around in an 80cc xterm, so split into 2 comment lines and fixed grammar (extrs "the"). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Remove UTF8(?) sequencesDuncan Roe2018-08-041-11/+11
| | | | | | | | | | | | | | | | There were some forced hyphenations which only ever looked right in an 80-column terminal and now don't all look right even there e.g. searched for included files. This op- tion may be specified Also the URL on the last line a"http://creativecommons.org/licenses/by-sa/4.0/a(C) Tested using man in the C locale Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add osf expression to man pageFernando Fernandez Mancera2018-08-041-0/+29
| | | | | Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: correct some typos in asciidocArushi Singhal2018-08-036-39/+29
| | | | | | | | Correct some typo mistakes done while converting man page source to asciidoc. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Expose socket mark via socket expressionMáté Eckl2018-08-031-0/+17
| | | | | | | | This can be used like ct mark or meta mark except it cannot be set. doc and tests are included. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add tproxy statement to man pageMáté Eckl2018-08-031-0/+58
| | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com>
* doc: statements.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-25/+83
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: stateful-objects.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-2/+7
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: primary-expression.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-3/+13
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: payload-expression.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-3/+21
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: data-types.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-7/+22
| | | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: nft.txt: Wrap extra long lines to 80 charsMáté Eckl2018-08-011-51/+183
| | | | | | | | | | | | | | | When I tried to send a patch that included man page update I got the following error from git send-email: fatal: patch.patch:287: patch contains a line longer than 998 characters Line 287 was a non-modified line so it was there before my patch. Even this patch can only be sent with mutt but not with git send-email. This patch tries to fix this issue by wrapping extra long lines to 80 characters wide. Signed-off-by: Máté Eckl <ecklm94@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: remove nft.xml from CLEANFILESFlorian Westphal2018-07-261-1/+1
| | | | | | | This file doesn't exist. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: doc: Convert man page source to asciidocArushi Singhal2018-07-268-5729/+2431
| | | | | | | This patch converts nft.xml into asciidoc markup. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: meta: always prefix 'meta' for almost all tokensFlorian Westphal2018-07-211-1/+1
| | | | | | | | | | | | | | | | | | got following bug report: nft add ... ct mark set mark and 0x10 ... always sets 0. What reporter meant to write instead was 'ct mark', not 'mark'. We can't just remove support for 'mark' and force 'meta mark', but we can start to discourage it by printing meta prefix too. Later on, we could start to print deprecation warning if needed. Followup patch can also change "iifname" etc. to "meta iifname". Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: describe dynamic flag and caveats for packet-path updatesFlorian Westphal2018-07-071-6/+8
| | | | | | | | | | | | | | | This fails: nft add table ip filter nft add chain ip filter input '{' type filter hook input priority 0 ';' '}' nft add set ip filter protocols '{' type inet_proto ';' '}' nft add rule ip filter input iifname lo set add ip protocol @protocols ^^^^^^^^^^^^^^^^^^^ ...as wrong set type gets chosen. Describe dynamic flag and that sets should have both timeout and max size set. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: update manpage to document --literal optionPablo Neira Ayuso2018-07-071-4/+8
| | | | | | | | This patch describe the new --literal option. Remove documentation on -N to prepare it for deprecation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add --literal optionPablo Neira Ayuso2018-07-071-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default not to print the service name as we discussed during the NFWS. # nft list ruleset table ip x { chain y { tcp dport 22 ip saddr 1.1.1.1 } } # nft -l list ruleset table ip x { chain y { tcp dport ssh ip saddr 1.1.1.1 } } # nft -ll list ruleset table ip x { chain y { tcp dport 22 ip saddr 1dot1dot1dot1.cloudflare-dns.com } } Then, -ll displays FQDN. just like the (now deprecated) --ip2name (-N) option. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add socket expression to man pageMáté Eckl2018-07-031-0/+56
| | | | Signed-off-by: Máté Eckl <ecklm94@gmail.com>
* doc: fix make distcheckEric Leblond2018-06-201-4/+4
| | | | | Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nftables: Fix typos/Grammatical ErrorsArushi Singhal2018-06-191-4/+4
| | | | | | | | typos/Grammatical errors are corrected. Signed-off-by: Arushi Singhal <arushisinghal19971997@gmail.com> Acked-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: libnftables-json: Review asciidoc syntaxPhil Sutter2018-06-181-184/+142
| | | | | | | | | | | | | | | | | | | | This changes asciidoc markup according to a few best practices recommended in [1] and a quick review of html output: * Use atx-style headings everywhere apart from the document title. This requires to explicitly disable compat-mode after the latter. * Use only the minimum number of dashes for listings. * Enclose verses with empty lines in a verse block instead of having multiple verses for it. * Indent continued lines in synopsis for added readability. [1] https://asciidoctor.org/docs/asciidoc-recommended-practices/ Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables: Simplify nft_run_cmd_from_buffer footprintPhil Sutter2018-06-181-5/+4
| | | | | | | | | | | | | | | | | | | | | | | With libnftables documentation being upstream and one confirmed external user (nftlb), time to break the API! First of all, the command buffer passed to nft_run_cmd_from_buffer may (and should) be const. One should consider it a bug if that function ever changed it's content. On the other hand, there is no point in passing the buffer's length as separate argument: NULL bytes are not expected to occur in the input, so it is safe to rely upon strlen(). Also, the actual parsers don't require a buffer length passed to them, either. The only use-case for it is when reallocating the buffer to append a final newline character, there strlen() is perfectly sufficient. Suggested-by: Harald Welte <laforge@gnumonks.org> Cc: Laura Garcia Liebana <nevola@gmail.com> Cc: Eric Leblond <eric@regit.org> Cc: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Fix typo in Makefile.amPhil Sutter2018-06-161-1/+1
| | | | | | | | Previous patch adding libnftables man page missed a backslash. Fixes: 3c57ff87b1b2b ("doc: Add libnftables man page") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Add libnftables man pagePhil Sutter2018-06-153-3/+324
| | | | | | | | For now, use a single man page to describe all the functions exported by libnftables. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Add JSON schema documentationPhil Sutter2018-06-113-4/+1251
| | | | | | | | | | The document is written as man page in asciidoc which means this adds another dependency to the build system. Though since the (long-term) plan is to replace the docbook-based nft man page with an asciidoc one anyway, we might ultimately get rid of docbook dependency in exchange. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft.8: Fix reject statement documentationPhil Sutter2018-06-061-5/+5
| | | | | | | | | | First of all, 'with icmp6' is invalid, expected is 'with icmpv6'. In addition to that, parameter 'type' expects an icmp*_code type, not icmp*_type. The respective table column was already correct, but in synopsis it was wrong. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft.8: Document limitation of reject statement in bridge familyPhil Sutter2018-05-171-0/+4
| | | | | | | | Bridge family allows reject statement in prerouting and input chains only. Users can't know without looking at kernel code. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft.8: Drop misleading adjective 'absolute'Phil Sutter2018-05-111-1/+1
| | | | | | | | Discussion showed that rule index may be interpreted as being absolute or relative, so just drop this adjective without replacement. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Support 'add/insert rule index <IDX>'Phil Sutter2018-05-091-7/+24
| | | | | | | | | | | Allow to specify an absolute rule position in add/insert commands like with iptables. The translation to rule handle takes place in userspace, so no kernel support for this is needed. Possible undesired effects are pointed out in man page to make users aware that this way of specifying a rule location might not be ideal. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Deprecate add/insert rule 'position' argumentPhil Sutter2018-05-091-4/+13
| | | | | | | | | | Instead, use 'handle' keyword for the same effect since that is more consistent with respect to replace/delete commands. The old keyword is still supported for backwards compatibility and also listed in man page along with a hint that it shouldn't be used anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add size keyword to meter exampleFlorian Westphal2018-05-091-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: update doc/ispell_nft to track recent nft.8 updatesDuncan Roe2018-05-031-2/+2
| | | | | | | | | Track changes in commits 3baa28f24b3d70a7ee17d584c113a2c4e057a565 and 4787edad132c30ae0f6bb00135ae5d970b0ccb74 (rename ibriport and obriport: s/iport/name). Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: reword insert position, this expects rule handle to insert, not a ↵Florian Westphal2018-04-241-3/+3
| | | | | | relative postition Signed-off-by: Florian Westphal <fw@strlen.de>
* src: use ibrname and obrnamePablo Neira Ayuso2018-04-191-4/+4
| | | | | | | | | Legacy tool name is 'brctl' and so the 'br' prefix is already known. If we use ibrname and obrname it looks consistent with iifname and oifname. So let's this instead of ibridgename and obridgename since Florian likes this too. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: rename ibrportname, obrportnameFlorian Westphal2018-04-171-4/+4
| | | | | | | | | | | | | | | For bridge, iifname is the port name, whereas 'ibrport' is the logical name of the bridge ("br0") the port ("iifname") is enslaved to. So, 'ibrport' is a misnomer. libnftl calls these 'bri_iifname' and 'bri_oifname', which is good but using 'briiifname' in nft is rather ugly, so use 'ibridgename' and 'obridgename' instead. Old names are still recognized, listing shows the new names. Signed-off-by: Florian Westphal <fw@strlen.de>