nftables - nft command line tool

	Commit message (Collapse)	Author	Age	Files	Lines
*	tests: shell: check for reset tcp options support	Pablo Neira Ayuso	2024-04-08	1	-0/+2
\| \| \| \| \|	Fixes: 59a33d08ab3a ("parser: tcpopt: fix tcp option parsing with NUM + length field") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
*	netlink_delinearize: restore binop syntax when listing ruleset for flags	Pablo Neira Ayuso	2024-03-20	1	-8/+8
\| \| \| \| \| \| \| \| \| \| \|	c3d57114f119 ("parser_bison: add shortcut syntax for matching flags without binary operations") provides a similar syntax to iptables using a prefix representation for flag matching. Restore original representation using binop when listing the ruleset. The parser still accepts the prefix notation for backward compatibility. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
*	parser: tcpopt: fix tcp option parsing with NUM + length field	Florian Westphal	2023-12-06	1	-0/+55
	tcp option 254 length ge 4 ... will segfault. The crash bug is that tcpopt_expr_alloc() can return NULL if we cannot find a suitable template for the requested kind + field combination, so add the needed error handling in the bison parser. However, we can handle this. NOP and EOL have templates, all other options (known or unknown) must also have a length field. So also add a fallback template to handle both kind and length, even if only a numeric option is given that nft doesn't recognize. Don't bother with output, above will be printed via raw syntax, i.e. tcp option @254,8,8 >= 4. Fixes: 24d8da308342 ("tcpopt: allow to check for presence of any tcp option") Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>