summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: add a comment wrt. reject dependency insertionFlorian Westphal2017-05-181-0/+8
| | | | | | | | at first I thought this was a bug but this in fact seems the right thing, add a comment/example why adding dependency as first statement makes sense. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: delete the old cache when dumping is interruptedLiping Zhang2017-05-171-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the dumping operation is interrupted, we will restart the cache_init(), but unfortunatly, we forget to delete the old cache. So in extreme case, we will leak a huge amount of memory. Running the following commands can simulate the extreme case: # nft add table t # nft add set t s {type inet_service \;} # for i in $(seq 65000); do nft add element t s {$i} done & # while : ; do time nft list ruleset -nn done After a while, oom killer will be triggered: [ 2808.243537] Out of memory: Kill process 16975 (nft) score 649 or sacrifice child [ 2808.255372] Killed process 16975 (nft) total-vm:1955348kB, anon-rss:1952120kB, file-rss:0kB, shmem-rss:0kB [ 2858.353729] nft invoked oom-killer: gfp_mask=0x14201ca(GFP_HIGHUSER_ MOVABLE|__GFP_COLD), nodemask=(null), order=0, oom_score_adj=0 [ 2858.374521] nft cpuset=/ mems_allowed=0 ... Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: print sets and maps in pretty formatArturo Borrero Gonzalez2017-05-155-13/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Print elements per line instead of all in a single line. The elements which can be 'short' are printed 5 per line, and others, like IPv4 addresses are printed 2 per line. Example: % nft list ruleset -nnn table ip t { set s { type inet_service elements = { 1, 2, 3, 4, 10, 432, 433, 434, 435, 436, 437, 438, 439, 440, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 12345 } } map m { type inet_service . iface_index : verdict elements = { 123 . "lo" : accept, 1234 . "lo" : accept, 12345 . "lo" : accept, 12346 . "lo" : accept, 12347 . "lo" : accept } } set s3 { type ipv4_addr elements = { 1.1.1.1, 2.2.2.2, 3.3.3.3 } } } Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delink_delinearize: don't store dependency unless relop checks is eq ↵Florian Westphal2017-05-151-1/+1
| | | | | | | | | | | check 'ip protocol ne 6' is not a dependency for nexthdr protocol, and must not be stored as such. Fixes: 0b858391781ba308 ("src: annotate follow up dependency just after killing another") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: don't kill dependencies accross statementsFlorian Westphal2017-05-082-0/+26
| | | | | | add a test case for previous commit. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: don't kill dependencies accross statementsFlorian Westphal2017-05-083-1/+34
| | | | | | | | | | | | | | | | | | | | nft currently translates ip protocol tcp meta mark set 1 tcp dport 22 to mark set 0x00000001 tcp dport 22 This is wrong, the latter form is same as mark set 0x00000001 ip protocol tcp tcp dport 22 and thats not correct (original rule sets mark for tcp packets only). We need to clear the dependency stack whenever we see a statement other than stmt_expr, as these will have side effects (counter, payload mangling, logging and the like). Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow listing sets in one tableFlorian Westphal2017-05-042-1/+5
| | | | | | | | | | | | | | currently nft can lists sets: nft list sets but unlike e.g. 'quotas' or 'counters' we didn't support restricting it to a table. Now its possible to restrict set definition listing to one table: nft list sets table inet filter Reported-by: Thomas Woerner <twoerner@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft.8: Enhance NAT documentationPhil Sutter2017-05-041-1/+57
| | | | | | | | | | This adds documentation about masquerade and redirect statements, points out that for any NAT statement both prerouting and postrouting chains are required and adds a bunch of examples to the section's end. Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: delete element and chain in transactionPablo Neira Ayuso2017-05-041-0/+76
| | | | | | | | This patch adds a test to test refcounting from element to chain and objects. Reported-by: Andreas Schultz <aschultz@tpip.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add conntrack event mask supportFlorian Westphal2017-04-247-64/+90
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hash: generate a random seed if seed option is emptyLiping Zhang2017-04-158-15/+35
| | | | | | | | | | | Typing the "nft add rule x y ct mark set jhash ip saddr mod 2" will not generate a random seed, instead, the seed will always be zero. So if seed option is empty, we shoulde not set the NFTA_HASH_SEED attribute, then a random seed will be generated in the kernel. Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix build warning on i686Florian Westphal2017-04-081-1/+1
| | | | | | | datatype.c:182:13: warning: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘uint64_t {aka long long unsigned int}’ [-Wformat=] printf("%lu", val); Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: avoid crash with older kernelsFlorian Westphal2017-04-081-16/+21
| | | | | | | | | | | | | | | | | | if kernel is older it won't understand the EXTHDR_OP attribute, i.e. the rule gets accepted as a check for ipv6 exthdr. On dump nft is then presented with a invalid ipv6 exthdr. So we need to get rid of the assert and output an "invalid" message on list. Longterm we need a proper vm description or kernel-side check to reject such messages in first place. After patch, test suite yields erros of type ip6/tcpopt.t: WARNING: 'src/nft add rule --debug=netlink ip6 test-ip6 \ input tcp option sack right 1': 'tcp option sack right 1' mismatches 'ip6 nexthdr 6 unknown-exthdr unknown 0x1 [invalid type]' Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: revisit fib examplesPablo Neira Ayuso2017-04-071-4/+4
| | | | | | There are several typos there that may confuse users, fix them. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: hash: fix seed attribute not listedLaura Garcia Liebana2017-03-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | The tests warned about a problem with the seed listing. /tests/py# ./nft-test.py ip/hash.t ip/hash.t: WARNING: line: 4: 'src/nft add rule --debug=netlink \ ip test-ip4 pre ct mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef': 'ct mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef' mismatches 'ct mark set jhash ip saddr . ip \ daddr mod 2' ip/hash.t: WARNING: line: 6: 'src/nft add rule --debug=netlink \ ip test-ip4 pre ct mark set jhash ip saddr . ip daddr mod 2 seed \ 0xdeadbeef offset 100': 'ct mark set jhash ip saddr . ip daddr \ mod 2 seed 0xdeadbeef offset 100' mismatches 'ct mark set jhash \ ip saddr . ip daddr mod 2 offset 100' ip/hash.t: 6 unit tests, 0 error, 2 warning The expression type is now treated as an unsigned int in the hash_expr_print() function. Fixes 3a86406 ("src: hash: support of symmetric hash") Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add test for flush command selectiveness on setsElise Lennion2017-03-241-0/+41
| | | | | | | | This tests the selectiveness of flush command on structures that use the generic set infrastructure (sets, maps and flow tables). Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Make flush command selective of the set structure typeElise Lennion2017-03-243-5/+38
| | | | | | | | | | | | | | | | | The internal set infrastructure is used for sets, maps and flow tables. The flush command requires the set type but currently it works for all of them. E.g. if there is a set named 's' in a table 't' the following command shouldn't be valid but still executes: $ nft flush flow table t s This patch makes the flush command selective so 'flush flow table' only works in flow tables and so on. Fixes: 6d37dae ("parser_bison: Allow flushing maps") Fixes: 2daa0ee ("parser_bison: Allow flushing flow tables") Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sets: Fix for missing space after last elementPhil Sutter2017-03-2216-32/+32
| | | | | | | | | | | Not having a space between the last element in a set and the closing curly brace looks ugly, so add it here. This also adjusts all shell testcases as they match whitespace in nft output and therefore fail otherwise. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: netns/0003many_0: Fix cleanup after errorPhil Sutter2017-03-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If rule set applying failed, this would leave a stray netns in place. Interestingly, this situation led to other, seemingly unrelated testcases to fail with spurious errors, e.g. sets/0015rulesetflush_0: | $ ./run-tests.sh testcases/sets/0015rulesetflush_0 | I: using nft binary ../../src/nft | | W: [FAILED] testcases/sets/0015rulesetflush_0: expected 0 but got 1 | /tmp/tmp.BY7cuUYL8f:5:1-2: Error: Could not process rule: Operation not supported | table inet filter { | ^^ | /tmp/tmp.BY7cuUYL8f:9:1-2: Error: Could not process rule: No such file or directory | add element inet filter blacklist_v4 { | ^^ | /tmp/tmp.BY7cuUYL8f:5:1-2: Error: Could not process rule: Operation not supported | table inet filter { | ^^ | /tmp/tmp.BY7cuUYL8f:9:1-2: Error: Could not process rule: No such file or directory | add element inet filter blacklist_v4 { | ^^ | | I: results: [OK] 0 [FAILED] 1 [TOTAL] 1 | | $ ip netns list | 1_0003many_0 | $ ip netns del 1_0003many_0 | | $ ./run-tests.sh testcases/sets/0015rulesetflush_0 | I: using nft binary ../../src/nft | | I: [OK] testcases/sets/0015rulesetflush_0 | | I: results: [OK] 1 [FAILED] 0 [TOTAL] 1 Signed-off-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Add test cases for nested anonymous setsPhil Sutter2017-03-225-0/+103
| | | | | | | | | This makes sure nesting of anonymous sets works regardless of whether defines are used or not. As a side-effect, it also checks that overlap checking when IP address prefixes are used, works. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: set: Fix nested set merge size adjustmentPhil Sutter2017-03-211-1/+1
| | | | | | | | | | | | | | | When merging a nested set into the parent one, we are actually replacing one item with the items of the nested set. Therefore we have to remove the replaced item from size. The respective bug isn't as easy to trigger, since the size field seems to be relevant only when set elements are ranges which are checked for overlaps. Here's an example of how to trigger it: | add rule ip saddr { { 1.1.1.0/24, 3.3.3.0/24 }, 2.2.2.0/24 } Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: set: Allow for set elems to be setsPhil Sutter2017-03-211-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | Recursive use of sets is handled in parts by parser_bison.y, which has a rule for inline unnamed sets in set_list_member_expr, e.g. like this: | add rule ip saddr { { 1.1.1.0, 2.2.2.0 }, 3.3.3.0 } Yet there is another way to have an unnamed set inline, which is via define: | define myset = { | 1.1.1.0, | 2.2.2.0, | } | add rule ip saddr { $myset, 3.3.3.0 } This didn't work because the inline set comes in as EXPR_SET_ELEM with EXPR_SET as key. This patch handles that case by replacing the former by a copy of the latter, so the following set list merging can take place. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Document add / delete element operations of sets and mapsElise Lennion2017-03-201-0/+58
| | | | | | | | | The add / delete operations weren't documented yet. They fit better in the sets and maps blocks since these operations are used to directly modify their content. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Allow flushing mapsElise Lennion2017-03-202-0/+13
| | | | | | | | | | | | | | This patch enables the command flush on maps, which removes all entries in it: $ nft flush map filter map1 Command above flushes map 'map1' in table 'filter'. The documentation was updated accordingly. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Allow flushing flow tablesElise Lennion2017-03-201-0/+4
| | | | | | | | | | | | This patch enables the command flush on flow tables, which removes all entries in it: $ nft flush flow table filter ft-https Command above flushes flow table 'ft-https' in table 'filter'. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Describe ICMP(v6) expression and typesPhil Sutter2017-03-201-0/+380
| | | | | | | | | This adds a description of the icmp and icmpv6 expressions (to match various ICMP header fields) as well as the icmp and icmpv6 type types (yay) which are used for ICMP(v6) type field. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: Add some exotic ICMPv6 typesPhil Sutter2017-03-203-3/+47
| | | | | | | | | | | | | | | This adds support for matching on inverse ND messages as defined by RFC3122 (not implemented in Linux) and MLDv2 as defined by RFC3810. Note that ICMPV6_MLD2_REPORT macro is defined in linux/icmpv6.h but including that header leads to conflicts with symbols defined in netinet/icmp6.h. In addition to the above, "mld-listener-done" is introduced as an alias for "mld-listener-reduction". Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: ct helper objects and helper set supportFlorian Westphal2017-03-161-0/+76
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: add insert-failure testFlorian Westphal2017-03-162-3/+15
| | | | | | | It should not be possible to add a ip6 restricted helper to ip family. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: add ct helper testsFlorian Westphal2017-03-163-1/+28
| | | | | | | needs minor tweak to nft-test.py so we don't zap the ';' withhin the {}. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: implement add/create/delete for ct helper objectsFlorian Westphal2017-03-164-2/+91
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow listing all ct helpersFlorian Westphal2017-03-164-0/+23
| | | | | | | | | | | this implements nft list ct helpers table filter table ip filter { ct helper ftp-standard { .. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: refactor CMD_OBJ_QUOTA/COUNTER handlingFlorian Westphal2017-03-161-12/+20
| | | | | | | ... to make adding CMD_OBJ_CT_HELPER support easier. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add initial ct helper supportFlorian Westphal2017-03-168-5/+146
| | | | | | | | | | | | | | | | | This adds initial support for defining conntrack helper objects which can then be assigned to connections using the objref infrastructure: table ip filter { ct helper ftp-standard { type "ftp" protocol tcp } chain y { tcp dport 21 ct helper set "ftp-standard" } } Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix ct mark set exampleFlorian Westphal2017-03-151-1/+1
| | | | | Fixes: 0d7fdb10b10c7a6c ("doc: payload and conntrack statement") Signed-off-by: Florian Westphal <fw@strlen.de>
* files: provide 'raw' table equivalentFlorian Westphal2017-03-153-1/+15
| | | | | | | | | | useful for the 'ct zone set' statement, it has to be done before the conntrack lookup but preferrably after the defragmention hook. In iptables, the functionality resides in the CT target which is restricted to the raw table. This provides the skeleton for nft. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: ct zone set supportFlorian Westphal2017-03-151-1/+27
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: test comments with small setsPablo Neira Ayuso2017-03-131-0/+12
| | | | | | Just a test to cover the bitmap backend implementation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Document boolean type and applicationsPhil Sutter2017-03-131-0/+134
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: Adjust for changed exthdr debug outputPhil Sutter2017-03-132-14/+14
| | | | | | | | Debug output from libnftnl has changed to include 'present' keyword if NFT_EXTHDR_F_PRESENT flag is set in expression. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fib: Support existence checkPhil Sutter2017-03-137-2/+37
| | | | | | | | | | | | | | | | | This allows to check whether a FIB entry exists for a given packet by comparing the expression with a boolean keyword like so: | fib daddr oif exists The implementation requires introduction of a generic expression flag EXPR_F_BOOLEAN which allows relational expression to signal it's LHS that a boolean comparison is being done (indicated by boolean type on RHS). In contrast to exthdr existence checks, fib expression can't know this in beforehand because the LHS syntax is absolutely identical to a non-boolean comparison. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix crash when inputting an incomplete set add commandLiping Zhang2017-03-132-3/+2
| | | | | | | | | | | | | | | | | | | | | After inputting the following nft command, set->keytype is not initialized but we try to destroy it, so NULL pointer dereference will happen: # nft add set t s Segmentation fault (core dumped) #0 dtype_free (dtype=0x0) at datatype.c:1049 #1 set_datatype_destroy (dtype=0x0) at datatype.c:1051 #2 0x0000000000407f1a in set_free (set=0x838790) at rule.c:213 #3 0x000000000042ff70 in nft_parse (scanner=scanner@entry=0x8386a0, state=state@entry=0x7ffc313ea670) at parser_bison.c:9355 #4 0x000000000040727d in nft_run (scanner=scanner@entry=0x8386a0, state=state@entry=0x7ffc313ea670, msgs=msgs@entry=0x7ffc313ea660) at main.c:237 #5 0x0000000000406e4a in main (argc=<optimized out>, argv=<optimized out>) at main.c:376 Fixes: b9b6092304ae ("evaluate: store byteorder for set keys") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Implement existence checkPhil Sutter2017-03-1010-5/+166
| | | | | | | | | | | This allows to check for existence of an IPv6 extension or TCP option header by using the following syntax: | exthdr frag exists | tcpopt window exists Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* exthdr: Add support for exthdr specific flagsPhil Sutter2017-03-107-10/+18
| | | | | | | | | This allows to have custom flags in exthdr expression, which is necessary for upcoming existence checks (of both IPv6 extension headers as well as TCP options). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Introduce boolean datatype and boolean expressionPhil Sutter2017-03-104-0/+44
| | | | | Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: BUG when object type is unknownFlorian Westphal2017-03-081-0/+3
| | | | | | | | | | This will only trigger during development when adding new object types to the parser. The BUG() gives a clear hint where the serialization code needs to go. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use nftnl_udata_put_u32()/nftnl_udata_get_u32()Pablo Neira Ayuso2017-03-061-6/+8
| | | | | | | Use these new type-specific helper functions instead available in libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: hash: support of symmetric hashLaura Garcia Liebana2017-03-0611-36/+87
| | | | | | | | | | | | | | | | | | | | | This patch provides symmetric hash support according to source ip address and port, and destination ip address and port. The new attribute NFTA_HASH_TYPE has been included to support different types of hashing functions. Currently supported NFT_HASH_JENKINS through jhash and NFT_HASH_SYM through symhash. The main difference between both types are: - jhash requires an expression with sreg, symhash doesn't. - symhash supports modulus and offset, but not seed. Examples: nft add rule ip nat prerouting ct mark set jhash ip saddr mod 2 nft add rule ip nat prerouting ct mark set symhash mod 2 Signed-off-by: Laura Garcia Liebana <laura.garcia@zevenet.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: py: fix some typos in READMETimothy Redaelli2017-03-021-3/+3
| | | | | | | Python script name ends by .py instead of .sh Signed-off-by: Timothy Redaelli <tredaelli@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit tcp options supportPablo Neira Ayuso2017-02-2812-198/+243
| | | | | | | | | | | | | | | | | | | Rework syntax, add tokens so we can extend the grammar more easily. This has triggered several syntax changes with regards to the original patch, specifically: tcp option sack0 left 1 There is no space between sack and the block number anymore, no more offset field, now they are a single field. Just like we do with rt, rt0 and rt2. This simplifies our grammar and that is good since it makes our life easier when extending it later on to accomodate new features. I have also renamed sack_permitted to sack-permitted. I couldn't find any option using underscore so far, so let's keep it consistent with what we have. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>