nft: secmark output not understood by parser

nft: secmark output not understood by parser

[Phil Sutter]

Hi,

Looks like secmark support is broken:

| # nft add table t
| # nft add chain t c
| # nft add secmark t ssh  \"system_u:object_r:ssh_server_packet_t:s0\"
| # nft add rule t c tcp dport 22 meta secmark set ssh
| # nft list ruleset
| table ip t {
| 	secmark ssh {
| 		"system_u:object_r:ssh_server_packet_t:s0"
| 	}
| 
| 	chain c {
| 		tcp dport 22 secmark name "ssh"
| 	}
| }
| # nft list ruleset >/tmp/nft.dump
| # nft -f /tmp/nft.dump
| /tmp/nft.dump:7:16-22: Error: syntax error, unexpected secmark, expecting newline or semicolon
| 		tcp dport 22 secmark name "ssh"
|		             ^^^^^^^

Output should ideally match input or at least be accepted by nft when
fed back. Could you please have a look?

Apart from the above, this should be documented in nft.8 and
libnftables-json.5. Adding a test would help as well, at least in
tests/shell. AFAICT, integration into tests/py might be more work since
this thing does not support anonymous secmark objects, right?

Thanks, Phil