Netfilter-Devel Archive on
 help / color / Atom feed
* nft: secmark output not understood by parser
@ 2019-10-31 10:45 Phil Sutter
  0 siblings, 0 replies; only message in thread
From: Phil Sutter @ 2019-10-31 10:45 UTC (permalink / raw)
  To: Christian Göttsche; +Cc: netfilter-devel, Pablo Neira Ayuso


Looks like secmark support is broken:

| # nft add table t
| # nft add chain t c
| # nft add secmark t ssh  \"system_u:object_r:ssh_server_packet_t:s0\"
| # nft add rule t c tcp dport 22 meta secmark set ssh
| # nft list ruleset
| table ip t {
| 	secmark ssh {
| 		"system_u:object_r:ssh_server_packet_t:s0"
| 	}
| 	chain c {
| 		tcp dport 22 secmark name "ssh"
| 	}
| }
| # nft list ruleset >/tmp/nft.dump
| # nft -f /tmp/nft.dump
| /tmp/nft.dump:7:16-22: Error: syntax error, unexpected secmark, expecting newline or semicolon
| 		tcp dport 22 secmark name "ssh"
|		             ^^^^^^^

Output should ideally match input or at least be accepted by nft when
fed back. Could you please have a look?

Apart from the above, this should be documented in nft.8 and
libnftables-json.5. Adding a test would help as well, at least in
tests/shell. AFAICT, integration into tests/py might be more work since
this thing does not support anonymous secmark objects, right?

Thanks, Phil

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-31 10:45 nft: secmark output not understood by parser Phil Sutter

Netfilter-Devel Archive on

Archives are clonable:
	git clone --mirror netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ \
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone