summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* build: add missing backslash to list of CFLAGSTobias Klauser2017-01-161-1/+1
| | | | | | | | | Due to a missing backslash in the AM_CFLAGS list some warning flags do not get added to the generated default CLFAGS. Add the missing backslash to include them as well. Signed-off-by: Tobias Klauser <tklauser@distanz.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: sort set elements in netlink_get_setelems()Elise Lennion2017-01-103-0/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So users can better track their ruleset via git. Without sorting, the elements can be listed in a different order every time the set is created, generating unnecessary git changes. Mergesort is used. Doesn't sort sets with 'flags interval' set on. Pablo appends to this changelog description: Currently these interval set elements are dumped in order. We'll likely get new representations soon that may not guarantee this anymore, so let's revisit this later in case we need it. Without this patch, nft list ruleset with a set containing 40000 elements takes on my laptop: real 0m2.742s user 0m0.112s sys 0m0.280s With this patch: real 0m2.846s user 0m0.180s sys 0m0.284s Difference is small, so don't get nft more complicated with yet another getopt() option, enable this by default. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: use nftnl_nlmsg_build_hdr()Pablo Neira Ayuso2017-01-101-106/+103
| | | | | | | | Instead of nftnl_.*_nlmsg_build_hdr() since they rely on this generic function. This also helps us clean up source code indentation around this function call. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: remove obsolete tokensFlorian Westphal2017-01-081-6/+0
| | | | | | removed in c992153402c78d91e8be ("ct: allow resolving ct keys at run time"). Signed-off-by: Florian Westphal <fw@strlen.de>
* datatype: printf format warnings on 32-bit buildDuncan Roe2017-01-031-1/+1
| | | | | | | | This is %lu with uint64_t again. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1109 Signed-off-by: Duncan Roe <duncan_roe@acslink.net.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: fix search_in_include_path testAnatole Denis2017-01-031-2/+2
| | | | | | | | | | | clang emits a warning in this function as we're using a boolean as the third argument to strncmp. Indeed, this function only checks the first byte of the path as is, so files beginning with . will be incorrectly included from the current working directory instead of the include directory. Fixes: f92a1a5c4a87 ("scanner: honor absolute and relative paths via include file") Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support for stateful object monitoringPablo Neira Ayuso2017-01-032-0/+159
| | | | | | | This patch extends the event monitoring infrastructure to catch events of addition and removal of stateful objects. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for stateful object mapsPablo Neira Ayuso2017-01-036-14/+180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | You can create these maps using explicit map declarations: # nft add table filter # nft add chain filter input { type filter hook input priority 0\; } # nft add map filter badguys { type ipv4_addr : counter \; } # nft add rule filter input counter name ip saddr map @badguys # nft add counter filter badguy1 # nft add counter filter badguy2 # nft add element filter badguys { 192.168.2.3 : "badguy1" } # nft add element filter badguys { 192.168.2.4 : "badguy2" } Or through implicit map definitions: table ip filter { counter http-traffic { packets 8 bytes 672 } chain input { type filter hook input priority 0; policy accept; counter name tcp dport map { 80 : "http-traffic", 443 : "http-traffic"} } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add stateful object reference expressionPablo Neira Ayuso2017-01-036-0/+112
| | | | | | | | | This patch adds a new objref statement to refer to existing stateful objects from rules, eg. # nft add rule filter input counter name test counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: allow RESET token from rhsPablo Neira Ayuso2017-01-031-8/+8
| | | | | | | | | | Stateful objects have introduced a RESET token in the parser. This breaks the use of RESET from the rhs, to fix this: 1) I added a new rule to catch this case, thus, dccp doesn't break. 2) Update reject_opts so reject with tcp reset still works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: reset internal stateful objectsPablo Neira Ayuso2017-01-036-11/+96
| | | | | | | | | | | | | | | | | | | | | This patch allows you to atomically dump and reset stateful objects, eg. # nft list counters table ip filter { counter test { packets 1024 bytes 100000 } } # nft reset quotas table filter counter test { packets 1024 bytes 100000 } # nft reset quotas table filter counter test { packets 0 bytes 0 } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add/create/delete stateful objectsPablo Neira Ayuso2017-01-035-2/+310
| | | | | | | | | | | | | | | | This patch allows you to add and to delete objects, eg. # nft add quota filter test 1234567 bytes # nft list quotas table ip filter { quota test { 1234567 bytes } } # nft delete quota filter test Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: listing of stateful objectsPablo Neira Ayuso2017-01-037-3/+300
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch allows you to dump existing stateful objects, eg. # nft list ruleset table ip filter { counter test { packets 64 bytes 1268 } quota test { over 1 mbytes used 1268 bytes } chain input { type filter hook input priority 0; policy accept; quota name test drop counter name test } } # nft list quotas table ip filter { quota test { over 1 mbytes used 1268 bytes } } # nft list counters table ip filter { counter test { packets 64 bytes 1268 } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add used quota supportPablo Neira Ayuso2017-01-035-3/+29
| | | | | | | | | | | | | table ip x { chain y { type filter hook forward priority 0; policy accept; quota over 200 mbytes used 1143 kbytes drop } } This patch allows us to list and to restore used quota. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove SET_F_* flag definitionsPablo Neira Ayuso2017-01-036-44/+44
| | | | | | | They map exactly one to one to we have in the kernel headers, so use kernel definitions instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: allocate memory for arrays on heapOleksandr Natalenko2017-01-031-1/+10
| | | | | | | | | Huge sets may cause stack to be exhausted. So, put allocate memory for arrays in interval_map_decompose() function on heap. Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name> Signed-off-by: Florian Westphal <fw@strlen.de>
* utils: provide array allocation wrapperOleksandr Natalenko2017-01-031-0/+11
| | | | | | | | This will be used for allocating memory for arrays in heap instead of keeping them on stack. Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name> Signed-off-by: Florian Westphal <fw@strlen.de>
* xt: use NFTNL_* definitionsPablo Neira Ayuso2016-12-201-6/+6
| | | | | | Do not use obsolete definitions in libnftnl. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: add mnl_nft_setelem_batch_flush() and use it from netlink_flush_setelems()Pablo Neira Ayuso2016-12-202-1/+28
| | | | | | | | | | | | | Commit 8bd99f2fca7e ("mnl: don't send empty set elements netlink message to kernel") broke set flush because we still need to send the netlink message with no elements to flush sets. To avoid more whack-a-mole games, add a new explicit function mnl_nft_setelem_batch_flush() that is used to request a set flush, instead of reusing the one that allows us to explicitly delete given set elements. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* expression: Show the base which pre-defined constants are displayedElise Lennion2016-12-207-1/+24
| | | | | | | | | | so the user know how we express it. The base was added to all symbol tables, which are associated with datatype->sym_tbl, so they are displayed in the right base. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: fix IPv6 layer 4 checksum manglingPablo Neira Ayuso2016-12-161-5/+4
| | | | | | | In IPv6 there is no checksum field. We always have to trigger layer 4 checksum mangling if any of the layer 3 pseudoheader fields are updated. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: don't send empty set elements netlink message to kernelPablo Neira Ayuso2016-12-141-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following command: # nft --debug=mnl add rule x y flow table xyz { ip saddr timeout 30s counter } breaks with EINVAL. The following netlink message is causing the problem: ... ---------------- ------------------ | 0000000044 | | message length | | 02572 | R--- | | type | flags | | 0000000004 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 02 00 00 00 | | extra header | |00008|--|00002| |len |flags| type| | 78 79 7a 00 | | data | x y z |00008|--|00004| |len |flags| type| | 00 00 00 01 | | data | |00006|--|00001| |len |flags| type| | 78 00 00 00 | | data | x ---------------- ------------------ ... This is incorrect since this describes no elements at all, so it is useless. Add upfront check before iterating over the list of set elements so the netlink message is not placed in the batch. This patch also adds a set so flow tables are minimally covered. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: don't trigger error on exact overlapsPablo Neira Ayuso2016-12-131-0/+4
| | | | | | | | | | | | | | | | So adding the same element doesn't trigger any error: # nft add element filter bogons { 3.3.3.123/24 } # nft add element filter bogons { 3.3.3.123/24 } Still kernel reports an error if we use create instead: # nft create element filter bogons { 3.3.3.123/24 } <cmdline>:1:1-46: Error: Could not process rule: File exists create element filter bogons { 3.3.3.123/24 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: wrong prefix expression length on interval_map_decompose()Pablo Neira Ayuso2016-12-131-1/+2
| | | | | | | | | | | | | | | | | interval_map_decompose() sets expr->len to zero. This causes problems from expr_to_intervals() that calls range_expr_value_high() and calculates: expr->len - expr->prefix_len this operation underflows, then mpz_init_bitmask() allocates a huge bitmask. Use expr_value(i)->len given that we already use this to calculate the prefix length. Reported-by: Richard Mörbitz <richard.moerbitz@tu-dresden.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Display pre-defined inet_service values in decimal baseElise Lennion2016-12-112-3/+7
| | | | | | | | | because the convention is to represent ports in base 10. gcc-workaround is no longer needed and was removed. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Display pre-defined inet_service values in host byte orderElise Lennion2016-12-102-5/+24
| | | | | | | | | | | | nft describe displays, to the user, which values are available for a selector, then the values should be in host byte order. Variable size was replaced by len to better match the common pattern. Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Fixes: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support to flush setsPablo Neira Ayuso2016-12-053-1/+14
| | | | | | | | | | You can use this new command to remove all existing elements in a set: # nft flush set filter xyz After this command, the set 'xyz' in table 'filter' becomes empty. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: trigger layer 4 checksum when pseudoheader fields are modifiedPablo Neira2016-12-042-0/+23
| | | | | | | | This patch sets the NFT_PAYLOAD_L4CSUM_PSEUDOHDR when any of the pseudoheader fields are modified. This implicitly enables stateless NAT, that can be useful under some circuntances. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: return ctx->table from table_lookup_global()Pablo Neira Ayuso2016-12-011-1/+1
| | | | | | | | | | Instead of returning ctx->cmd->table. Note that ctx->cmd->table and ctx->table points to the same object when all commands are embedded into the table definition. But this is not true if we mix table definitions with linear list commands in one file that we load via nft -f. Reported-by: Martin Bednar <martin@serafean.cz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Update cache on flush rulesetAnatole Denis2016-12-011-1/+24
| | | | | | | | | | | | | | After a flush, the cache should be empty, otherwise the cache and the expected state are desynced, causing unwarranted errors. See tests/shell/testcases/cache/0002_interval_0. `flush table` and `flush chain` don't empty sets or destroy chains, so the cache does not need an update in those cases, since only chain names and set contents are held in cache for commands other than "list" Reported-by: Leon Merten Lohse <leon@green-side.de> Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: Introduce helper function cache_flushAnatole Denis2016-12-011-1/+6
| | | | | | | | | cache_release empties the cache, and marks it as uninitialized. Add cache_flush, which does the same, except it keeps the cache initialized, eg. after a "nft flush ruleset" when empty is the correct state of the cache. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: honor -nn option from inet_service_type_print()Pablo Neira Ayuso2016-11-301-0/+4
| | | | | | | | If -nn is passed, we have to display ports in numbers, not as a symbol. Fixes: ccc5da470e76 ("datatype: Replace getnameinfo() by internal lookup table") Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* bison: remove old log level tokensFlorian Westphal2016-11-301-8/+0
| | | | | | | not used anymore since 0423caa91ad26e7 ("src: don't need keyword for log level") Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* datatype: Replace getnameinfo() by internal lookup tableElise Lennion2016-11-303-13/+346
| | | | | | | | | | | | | | | To avoid exceeding the inputs number limit of the flex scanner used, when calling getnameinfo() in inet_service_type_print(). The new symbol_table was associated with inet_service_type, to enable listing all pre-defined services using nft command line tool. The listed services are all well-known and registered ports of my local /etc/services file, from Ubuntu 16.04. Service numbers are converted to respect network byte order. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: Allow parens on RHS of relational_exprPhil Sutter2016-11-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is useful to allow a construct such as: | tcp flags & (syn|fin) == (syn|fin) Before, only the parentheses on the left side were allowed, but via a quite funny path through the parser: * expr might be a concat_expr * concat_expr might be a basic_expr * basic_expr is an inclusive_or_expr * inclusive_or_expr might be an exclusive_or_expr * exclusive_or_expr might be an and_expr * and_expr might be 'and_expr AMPERSAND shift_expr' -> here we eliminate 'flags &' in above statement * shift_expr might be a primary_expr * primary_expr might be '( basic_expr )' Commit a3e60492a684b ("parser: restrict relational rhs expression recursion") introduced rhs_expr to disallow recursion on RHS, so just reverting that change for relational_expr is a no go. Allowing rhs_expr to be '( rhs_expr )' though seems way too intrusive to me since it's being used in all kinds of places, so this patch is the safest way to allow the above I could come up with. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Interpret OP_NEQ against a set as OP_LOOKUPAnatole Denis2016-11-293-5/+33
| | | | | | | | | | Now that the support for inverted matching is in the kernel and in libnftnl, add it to nftables too. This fixes bug #888 Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "evaluate: check for NULL datatype in rhs in lookup expr"Anatole Denis2016-11-291-23/+8
| | | | | | | | | This reverts commit 5afa5a164ff1c066af1ec56d875b91562882bd50. This commit is obsoleted by removing the possibility for a NULL right->dtype in the first place, at set declaration. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Add set to cache only when well-formedAnatole Denis2016-11-291-3/+3
| | | | | | | | | | | | | | | When creating a set (in set_evaluate), it is added to the table cache before being checked for correctness. When the set is ill-formed, the function returns without removing the (non-existent, since the function returned) set. Further references to this set will not result in an error (since the set is in the lookup table), but the malformed set will probably cause a segfault. The symptom (the segfault) was fixed by checking for NULL when evaluating a reference to the set (commit 5afa5a164ff1c066af1ec56d875b91562882bd50), this should fix the root cause. Signed-off-by: Anatole Denis <anatole@rezel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add log flags syntax supportLiping Zhang2016-11-246-6/+89
| | | | | | | | | | | | | | | | | | | | | Now NF_LOG_XXX is exposed to the userspace, we can set it explicitly. Like iptables LOG target, we can log TCP sequence numbers, TCP options, IP options, UID owning local socket and decode MAC header. Note the log flags are mutually exclusive with group. Some examples are listed below: # nft add rule t c log flags tcp sequence,options # nft add rule t c log flags ip options # nft add rule t c log flags skuid # nft add rule t c log flags ether # nft add rule t c log flags all # nft add rule t c log flags all group 1 <cmdline>:1:14-16: Error: flags and group are mutually exclusive add rule t c log flags all group 1 ^^^ Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* mnl: use nftnl_set_elems_nlmsg_build_payload_iter() when deleting elementsPablo Neira Ayuso2016-11-141-14/+11
| | | | | | | | | Otherwise, nft crashes when deleting a very large number of elements. *** stack smashing detected ***: nft terminated Segmentation fault Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add notrack supportPablo Neira Ayuso2016-11-146-0/+44
| | | | | | | This patch adds the notrack statement, to skip connection tracking for certain packets. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* segtree: keep element comments in set intervalsPablo Neira Ayuso2016-11-091-3/+7
| | | | | | | | | The conversion from the set element range representation to element intervals doesn't keep the comment information around. Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1090 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Tested-by: Arturo Borrero Gonzalez <arturo@debian.org>
* src: add offset attribute for hash expressionLaura Garcia Liebana2016-11-094-8/+15
| | | | | | | | | | | Add support to add an offset to the hash generator, eg. ct mark set hash ip saddr mod 10 offset 100 This will generate marks with series between 100-109. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: make hash seed attribute optionalLaura Garcia Liebana2016-11-091-0/+5
| | | | | | | | | | | | | | | | | | The hash expression requires a seed attribute to call the jhash operation, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 \ seed 0xdeadbeef With this patch the seed attribute is optional and it's generated by a random function from userspace, eg. # nft add rule x y meta mark set jhash ip saddr . ip daddr mod 2 The kernel will take care of generate a random seed. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xt: update Arturo Borrero Gonzalez email addressArturo Borrero Gonzalez2016-11-091-1/+1
| | | | | | | Update email address to a new one in the copyright notice. Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_linearize: skip set element expression in flow table keyPablo Neira Ayuso2016-10-311-3/+3
| | | | | | | | | | | | | | | | | | | | | Anders reports that: # nft add rule ip6 filter postrouting \ flow table acct_out \{ meta iif . ip6 saddr timeout 600s counter \} while the opposite doesn't work: # nft add rule ip6 filter postrouting \ flow table acct_out \{ ip6 saddr . meta iif timeout 600s counter \} netlink_gen_flow_stmt() relies on the flow table key, that is expressed as a set element. Use the set element key instead to skip the set element wrap, otherwise get_register() abort execution: nft: netlink_linearize.c:650: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. Reported-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* evaluate: Allow concatenation of rt nexthop etc.Anders K. Pedersen2016-10-311-7/+7
| | | | | | | | | | | | | | | | | | | Concatenations of rt nexthop or ct {orignal | reply} {saddr | daddr} fail due to # nft add rule ip filter postrouting flow table acct \{ ip saddr . rt nexthop counter \} <cmdline>:1:61-70: Error: can not use variable sized data types (invalid) in concat expressions add rule ip filter postrouting flow table acct { ip saddr . rt nexthop counter } ~~~~~~~~~~~^^^^^^^^^^ Fix this by reordering the check for variable size data types in expr_evaluate_concat() to happen after expr_evaluate() has been called (via list_member_evaluate()) for the sub expression. This allows expr_evaluate_[cr]t() to call [cr]t_expr_update_type() and set the data type before the check. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* log: rename the log level "warning" to "warn"Liping Zhang2016-10-311-1/+1
| | | | | | | | | This is to keep compatibility. The original keyword in grammer is "warn" instead of "warning". Fixes: 0423caa91ad2 ("src: don't need keyword for log level") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: fix "ct l3proto/protocol" syntax brokenLiping Zhang2016-10-301-1/+3
| | | | | | | | | | | | | | | "l3proto" and "protocol" are still keywords in our grammer, they are not STRING, so if the user input the following rule, nft will complain that the syntax is error: # nft add t c ct l3proto ipv4 <cmdline>:1:12-18: Error: syntax error, unexpected l3proto, expecting string or mark or packets or bytes add t c ct l3proto ipv4 ^^^^^^^ Fixes: c992153402c7 ("ct: allow resolving ct keys at run time") Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Correct description of -n/--numeric optionJon Jensen2016-10-291-3/+2
| | | | | | | | | | | | "When used twice" was used twice in the manpage. :) And as Florian Westphal pointed out, it was also incorrect for the -nn case. Update the manpage and built-in help in main.c to match actual behavior. Signed-off-by: Jon Jensen <jon@endpoint.com> Signed-off-by: Florian Westphal <fw@strlen.de>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-15 01:10:41 +0000