summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: add test script for race-free restoreFlorian Westphal2019-04-271-0/+119
| | | | | | | | | | | | | | | | | | | | | | | | | | xtables-nft-restore ignores -w, check that we don't add duplicate rules when parallel restores happen. With a slightly older iptables-nft version this ususally fails with: I: [EXECUTING] iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 iptables-restore v1.8.2 (nf_tables): line 5: CHAIN_USER_ADD failed (File exists): chain UC-0 line 6: CHAIN_USER_ADD failed (File exists): chain UC-1 W: [FAILED] ipt-restore/0004-restore-race_0: expected 0 but got 4 or I: [EXECUTING] iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 iptables-restore v1.8.2 (nf_tables): line 1: TABLE_FLUSH failed (No such file or directory): table filter or /tmp/tmp.SItN4URxxF /tmp/tmp.P1y4LIxhTl differ: byte 7159, line 137 As the legacy version should not have such race (due to nature of full-table-replace), only do one iteration for legacy case. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: handle concurrent ruleset modificationsFlorian Westphal2019-04-272-4/+128
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We currently race when several xtables-nft-restore processes attempt to handle rules in parallel. For instance, when no rules are present at all, then iptables-nft-restore < X & iptables-nft-restore < X ... can cause rules to be restored twice. Reason is that both processes might detect 'no rules exist', so neither issues a flush operation. We can't unconditionally issue the flush, because it would cause kernel to fail with -ENOENT unless the to-be-flushed table exists. This change passes the generation id that was used to build the transaction to the kernel. In case another process changed *any* rule somewhere, the transaction will now fail with -ERESTART. We then flush the cache, re-fetch the ruleset and refresh our transaction. For example, in the above 'parallel restore' case, the iptables-restore instance that lost the race would detect that the table has been created already, and would add the needed flush. In a similar vein, in case --noflush is used, we will add the flush op for user-defined chains that were created in the mean-time. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add and set "implict" flag on transaction objectsFlorian Westphal2019-04-271-19/+24
| | | | | | | | | | | | | | | | | | | | | | Its used to flag the rule flushes that get added in user-defined-chains that get redefined with --noflush. IOW, those objects that are added not by explicit instruction but to keep semantics. With --noflush, iptables-legacy-restore will behave as if -F USERCHAIN was given, in case USERCHAIN exists and USERCHAIN gets redefined, i.e.: iptables-save v1.8.2 on Thu Apr 18 17:11:05 2019 *filter :USERCHAIN - [0:0] COMMIT ... will remove all existing rules from USERCHAIN. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add and use nft_build_cacheFlorian Westphal2019-04-273-9/+26
| | | | | | | | | | | | Will be used with the "generation id" infrastructure. When we're told that the commit failed because someone else made changes, we can use this to re-initialize the cache and then revalidate the transaction list (e.g. to detect that we now have to flush the user-defined chain 'foo' that we wanted to create, but was added just now by someone else). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: add skip flag to objectsFlorian Westphal2019-04-271-18/+31
| | | | | | | | | | | | This will be used to skip transaction objects when committing to kernel. This is needed for example when we restore a table that doesn't exist yet. In such a case we would already build a flush operation so we can just enable it when we hit problem with the generation id and we find that the table/chain was already created in the mean time. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: unify user chain add/flush for restore caseFlorian Westphal2019-04-275-78/+59
| | | | | | | | | | | | The idea here is to move the 'flush' decision into the core, rather than have the decision in the frontend. This will be required later when "generation id" is passed to kernel. In this case, we might have to add the flush when re-trying the transaction. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: return-codes script is bash specificFlorian Westphal2019-04-191-1/+1
| | | | | | The script fails on systems where sh is not bash. Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: libxt_osf.: Typo in manpageSam Banks2019-04-051-1/+1
| | | | | Signed-off-by: Sam Banks <sam.banks.nz@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-legacy: add missing config.h includeLucas Stach2019-04-031-0/+1
| | | | | | | | | | | This fixes a IPv4 only build, where this file would have references to functions that aren't built in this case. I'm not sure how it ends up with ENABLE_IPV6 defined without the config.h include, but since this was clearly missing and fixed my issue, I didn't bother tracking down the chain. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* man: iptables-save: Add note about module autoloadingPhil Sutter2019-04-031-2/+5
| | | | | | | | | Using '-t' parameter in iptables-save might lead to kernel module loading, just like with iptables itself. Copy the hint from iptables.8 to inform users. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: Install symlinks as suchPhil Sutter2019-04-031-4/+11
| | | | | | | | | | | | Fake shared objects which are actually symlinks to others are installed using 'install' tool which follows them and therefore installs a copy of the file they point at. Fix this by introducing special handling for them in install target. Reported-by: Wenle Chen <solachenclever@hotmail.com> Fixes: 269655d54e22f ("build: remove symlink-only extensions from static object list") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables-save: Point at existing man page in help textPhil Sutter2019-03-141-3/+6
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-legacy.8: Remove stray colonPhil Sutter2019-03-141-1/+1
| | | | | | | | This obviously doesn't belong there. Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Adjust ebtables man pagePhil Sutter2019-03-141-97/+67
| | | | | | | | | | | Change content to match nft-variant, most notably: * There is no broute table, drop all references to it * Comment out description of among and string matches, we don't support them (yet) Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Add ebtables man pagePhil Sutter2019-03-142-1/+1148
| | | | | | | This is a 1:1 copy from legacy ebtables repository. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Adjust arptables man pagesPhil Sutter2019-03-143-35/+39
| | | | | | | | | | | Change content to suit the shipped nft-based variant. Most relevant changes: * FORWARD chain is not supported * arptables-nft-save supports a few parameters Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Add arptables-nft man pagesPhil Sutter2019-03-144-0/+433
| | | | | | | These are 1:1 copies from legacy arptables repository. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: connlabel: Fallback on missing connlabel.confPhil Sutter2019-03-083-32/+48
| | | | | | | | | | | | If connlabel.conf was not found, fall back to manually parsing arguments as plain numbers. If nfct_labelmap_new() has failed, nfct_labelmap_get_name() segfaults. Therefore make sure it is not called in connlabel_get_name() if that's the case. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Add testcase for libxt_ipvsPhil Sutter2019-02-221-0/+20
| | | | | | | Given that it is fixed now, make it stay. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix ipvs vproto option printingPhil Sutter2019-02-221-1/+1
| | | | | | | | | This was broken since day 1: vproto option was printed as 'proto' which in turn iptables wouldn't accept anymore. Fixes: c36d05e424069 ("libxt_ipvs: user-space lib for netfilter matcher xt_ipvs") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix ipvs vproto parsingPhil Sutter2019-02-221-4/+1
| | | | | | | | | | | | | | This was broken by integration into guided option parser: * Make 'vproto' option XTTYPE_PROTOCOL, otherwise its arguments are parsed as garbage only. * Drop O_VPROTO case from ipvs_mt_parse(), due to XTOPT_POINTER() and above change there is nothing to do for it in there. Fixes: 372203af4c70f ("libxt_ipvs: use guided option parser") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: AUDIT: Document ineffective --type optionPhil Sutter2019-02-221-2/+4
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Install ip{6,}tables-translate.8 manpagesPhil Sutter2019-02-222-0/+7
| | | | | | | These are just semantic links to xtables-translate.8. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: Support testing host binariesPhil Sutter2019-02-221-16/+32
| | | | | | | | | | | | | | Add -H/--host parameter to run the testsuite against host system's binaries. While being at it, rewrite parameter parsing: * Parse all parameters in a loop, this frees any ordering constraints. * Set extglob option so strict pattern matching for single testcase mode can be done via bash globbing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xlate-test: Support testing host binariesPhil Sutter2019-02-221-3/+11
| | | | | | | | | | | Introduce --host parameter to run the testsuite against host's binaries instead of built ones. Apparently, extending PATH variable in main() was redundant with explicit full path call in run_test() so drop the former. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: fix decoding of hlen on bigendian platformsFlorian Westphal2019-02-221-2/+3
| | | | | | | | | | | | | | | The existing test fail with: extensions/libarpt_standard.t: ERROR: line 2 (cannot find: arptables -I INPUT -s 192.168.0.1) ... because hlen is 0 instead of expected "6". The rule is correct, i.e. this is a decode/display bug: arp_hlen is specified as 'unsigned short' instead of uint8_t. On LSB systems, this doesn't matter but on MSB the value then is '0x600' instead of '0x006' which becomes 0 when assignment to the u8 header field. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Phil Sutter <phil@nwl.cc>
* arptables: Print space before comma and countersPhil Sutter2019-02-212-7/+7
| | | | | | | | | Legacy arptables separates counters from rest of rule by ' , '. Assuming that scripts scraping 'arptables -vL' output match on this, make arptables-nft output conformant. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Extend return codes check by error messagesPhil Sutter2019-02-131-13/+46
| | | | | | | Check that error messages match between legacy and nft code. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error message for chain renamingPhil Sutter2019-02-131-1/+7
| | | | | | | | | If the new name already exists, legacy iptables prints "File exists.". This is a bit exotic, but more appropriate than "No chain/target/match by that name." printed by iptables-nft without this patch. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error messages in commands with rule numberPhil Sutter2019-02-131-6/+6
| | | | | | | | | | | | Use E2BIG if rule identified by given number is not found. ENOENT is used if referenced chain is not found. Without this, a command specifying a non-existing chain in combination with a rule number like e.g.: 'iptables-nft -I nonexist 23 -j ACCEPT' returns "Index of insertion too big." instead of "No chain/target/match by that name." like legacy iptables does. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Move new chain check to where it belongsPhil Sutter2019-02-132-3/+5
| | | | | | | | Instead of checking chain existence in xtables.c, do it in nft_chain_user_add() and reuse predefined error message. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix error message when zeroing a non-existent chainPhil Sutter2019-02-131-1/+3
| | | | | | | | | | | | | Previously, error message was a bit misleading: | # iptables-nft -Z noexist | iptables: Incompatible with this kernel. Set errno value so that the typical "No chain/target/match by that name." is printed instead. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: Eliminate dead code in __nft_rule_listPhil Sutter2019-02-111-12/+1
| | | | | | | | | | | If passed a rulenum > 0, the function uses nftnl_rule_lookup_byindex() and returns early. Negative rulenum values are not supposed to happen, so the remaining code which iterates over the full list of rules does not need to respect rulenum anymore. Fixes: 039b048965210 ("nft: Make use of nftnl_rule_lookup_byindex()") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-nft: Support user-defined chain policiesPhil Sutter2019-02-086-19/+265
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Legacy ebtables supports policies for user-defined chains - and what's worse, they default to ACCEPT unlike anywhere else. So lack of support for this braindead feature in ebtables-nft is actually a change of behaviour which very likely affects all ebtables users out there. The solution implemented here uses an implicit (and transparent) last rule in all user-defined ebtables-nft chains with policy other than RETURN. This rule is identified by an nft comment "XTABLES_EB_INTERNAL_POLICY_RULE" (since commit ccf154d7420c0 ("xtables: Don't use native nftables comments") nft comments are not used otherwise). To minimize interference with existing code, this policy rule is removed from chains during cache population and the policy is saved in NFTNL_CHAIN_POLICY attribute. When committing changes to the kernel, nft_commit() traverses through the list of chains and (re-)creates policy rules if required. In ebtables-nft-restore, table flushes are problematic. To avoid weird kernel error responses, introduce a custom 'table_flush' callback which removes any pending policy rule add/remove jobs prior to creating the NFT_COMPAT_TABLE_FLUSH one. I've hidden all this mess behind checks for h->family, so hopefully impact on {ip,ip6,arp}tables-nft should be negligible. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Introduce UDATA_TYPE_EBTABLES_POLICYPhil Sutter2019-02-081-0/+3
| | | | | | | | | This will be used later to identify ebtables user-defined chain policy rules. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Don't assume NFTNL_RULE_USERDATA holds a commentPhil Sutter2019-02-081-17/+22
| | | | | | | | | If this rule attribute is present but does not contain a comment, get_comment() returns NULL which is then fed into strncpy() causing a crash. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-save: Fix table not found error messagePhil Sutter2019-02-081-2/+3
| | | | | | | | | | First of all, this error message should not appear on stdout, otherwise it may end in dump files. Next, with completely empty ruleset, even valid table names cause errors. To avoid this, continue operation if the not found table is a builtin one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Explicitly pass target to command_jump()Phil Sutter2019-02-078-9/+9
| | | | | | | | | The use of global 'optarg' variable inside that function is a mess, but most importantly it limits its applicability to input parsers. Fix this by having it take the option argument as a parameter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* Revert "ebtables: use extrapositioned negation consistently"Phil Sutter2019-02-0517-70/+62
| | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5f508b76a0cebaf91965ffa678089222e2d47964. While attempts at unifying syntax between arp-, eb- and iptables-nft increase the opportunity for more code-sharing, they are problematic when it comes to compatibility. Accepting the old syntax on input helps, but due to the fact that neither arptables nor ebtables support --check command we must expect for users to test existence of a rule by comparing input with output. If that happens in a script, deviating from the old syntax in output has a high chance of breaking it. Therefore revert Florian's patch changing inversion character position in output and review the old code for consistency - the only thing changed on top of the actual revert is ebtables' own copy of print_iface() to make it adhere to the intrapositioned negation scheme used throughout ebtables. Added extension tests by the reverted commit have been kept. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for false-positive rule matchingPhil Sutter2019-02-057-72/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | When comparing two rules with non-standard targets, differences in targets' payloads wasn't respected. The cause is a rather hideous one: Unlike xtables_find_match(), xtables_find_target() did not care whether the found target was already in use or not, so the same target instance was assigned to both rules and therefore payload comparison happened over the same memory location. With legacy iptables it is not possible to reuse a target: The only case where two rules (i.e., iptables_command_state instances) could exist at the same time is when comparing rules, but that's handled using libiptc. The above change clashes with ebtables-nft's reuse of target objects: While input parsing still just assigns the object from xtables_targets list, rule conversion from nftnl to iptables_command_state allocates new data. To fix this, make ebtables-nft input parsing use the common command_jump() routine instead of its own simplified copy. In turn, this also eliminates the ebtables-nft-specific variants of parse_target(), though with a slight change of behaviour: Names of user-defined chains are no longer allowed to contain up to 31 but merely 28 characters. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for crash when comparing rules with standard targetPhil Sutter2019-02-013-5/+29
| | | | | | | | | | When parsing an nftnl_rule with a standard verdict, nft_rule_to_iptables_command_state() initialized cs->target but didn't care about cs->target->t. When later comparing that rule to another, compare_targets() crashed due to unconditional access to t's fields. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* extensions: Fix arptables extension testsPhil Sutter2019-02-014-10/+10
| | | | | | | | | | | With changes to arptables-nft output, many of these tests fail because rules are not printed as expected anymore. Since most of the tests with explicitly defined output did so just because of added --h-length and --h-type options, adjust input a little more (typically reordering of arguments) to make output match input. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Set h-type/h-length masks by default, tooPhil Sutter2019-02-011-2/+6
| | | | | | | | | | These masks are not used in nftables backend, but mangle extension checks arhln_mask value to make sure --h-length was given (which is implicitly the case). Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* nft: Fix potential memleaks in nft_*_rule_find()Phil Sutter2019-02-013-14/+26
| | | | | | | | | These functions parse an nftnl_rule into a local instance of iptables_command_state which potentially allocates memory (for matches or target), so call ops->clear_cs() before returning to caller. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix rule listing with countersPhil Sutter2019-02-011-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a partial revert of commit 583b27eabcad6 ("ebtables-save: add -c option, using xtables-style counters") which broke ruleset listing with '--Lc' flag turned on: | # ebtables-nft -L --Lc | Bridge table: filter | | Bridge chain: INPUT, entries: 0, policy: ACCEPT | | Bridge chain: FORWARD, entries: 2, policy: ACCEPT | -j foo | , pcnt = 0 -- bcnt = 0-j ACCEPT | , pcnt = 0 -- bcnt = 0 | Bridge chain: OUTPUT, entries: 0, policy: ACCEPT | | Bridge chain: foo, entries: 1, policy: RETURN | -j ACCEPT | , pcnt = 0 -- bcnt = 0% (That percentage sign means no newline after last line of output and doesn't belong to ebtables-nft's output.) Problem was that nft_bridge_print_rule() printed the counters after nft_bridge_save_rule() had already printed the newline character. Note also that there is no need to remove FMT_EBT_SAVE bit from 'format' variable: It is set only by ebtables-nft-save which doesn't call nft_bridge_print_rule(). Fixes: 583b27eabcad6 ("ebtables-save: add -c option, using xtables-style counters") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Catch errors when zeroing rule rountersPhil Sutter2019-02-011-1/+3
| | | | | | | Covscan complained about call to batch_rule_add() not being checked. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: Add arptables-nft verbose output testPhil Sutter2019-01-311-0/+64
| | | | | | | | With arptables-nft output being in a very good state now, add a test to ensure it stays that way. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Don't print default h-len/h-type valuesPhil Sutter2019-01-313-21/+21
| | | | | | | | | | | | | | Default values for --h-len and --h-type being printed for rules where user didn't provide them is unexpected and confusing. The drawback is the opposite: If user provided either of them with their default value, they are later omitted when listing rules. Though since unlike legacy arptables we can't distinguish between not specified and specified with default value, we can't fix both - so choose to optimize for the more likely case. Fixes: 5aecb2d8bfdda ("arptables: pre-init hlen and ethertype") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft-save: Fix position of -j optionPhil Sutter2019-01-313-45/+58
| | | | | | | | | | | | | | | | | | Legacy arptables-save (just like arptables itself) prints verdict as first option, then matches and finally any target options. To achieve this without introducing double/trailing spaces everywhere, integrate target ('-j') option printing into nft_arp_print_rule_details() and make it print separating whitespace before each option. In nft_arp_save_rule(), replace the call to save_matches_and_target() by by a direct call to cs->target->save() since the former prints '-j' option itself. Since there are no match extensions in arptables, any other code from that function is not needed. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables-nft: Remove space between *cnt= and valuePhil Sutter2019-01-311-2/+2
| | | | | | | | When printing rule counters, call xtables_print_num() with FMT_NOTABLE bit set to avoid spaces between equal sign and value. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>