[nft PATCH v2 1/2] doc: nft.8: Mention wildcard interface matching

[nft PATCH v2 1/2] doc: nft.8: Mention wildcard interface matching

[Phil Sutter]

Special meaning of asterisk in interface names wasn't described
anywhere.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
Changes since v1:
- Generalize sentence about escaping for literal asterisk character.
---
 doc/primary-expression.txt | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt
index 94eccc20241a2..b5488790360dc 100644
--- a/doc/primary-expression.txt
+++ b/doc/primary-expression.txt
@@ -36,6 +36,13 @@ add such a rule, it will stop matching if the interface gets renamed and it
 will match again in case interface gets deleted and later a new interface
 with the same name is created.
 
+Like with iptables, wildcard matching on interface name prefixes is available for
+*iifname* and *oifname* matches by appending an asterisk (*) character. Note
+however that unlike iptables, nftables does not accept interface names
+consisting of the wildcard character only - users are supposed to just skip
+those always matching expressions. In order to match on literal asterisk
+character, one may escape it using backslash (\).
+
 .Meta expression types
 [options="header"]
 |==================
-- 
2.24.1

[nft PATCH v2 2/2] scanner: Extend asteriskstring definition

[Phil Sutter]

Accept escaped asterisks also mid-string and as only character.
Especially the latter will help when translating from iptables where
asterisk has no special meaning.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
Changes since v1:
- Still reject unescaped asterisks mid-string.
---
 src/scanner.l | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/scanner.l b/src/scanner.l
index 99ee83559d2eb..20a59de51d1ff 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -120,7 +120,7 @@ numberstring	({decstring}|{hexstring})
 letter		[a-zA-Z]
 string		({letter}|[_.])({letter}|{digit}|[/\-_\.])*
 quotedstring	\"[^"]*\"
-asteriskstring	({string}\*|{string}\\\*)
+asteriskstring	({string}\*|{string}\\\*|\\\*|{string}\\\*{string})
 comment		#.*$
 slash		\/
 
-- 
2.24.1

Re: [nft PATCH v2 1/2] doc: nft.8: Mention wildcard interface matching

[Pablo Neira Ayuso]

On Mon, Feb 10, 2020 at 12:14:22PM +0100, Phil Sutter wrote:
> Special meaning of asterisk in interface names wasn't described
> anywhere.

LGTM, thanks Phil.

Re: [nft PATCH v2 2/2] scanner: Extend asteriskstring definition

[Pablo Neira Ayuso]

On Mon, Feb 10, 2020 at 12:14:23PM +0100, Phil Sutter wrote:
> Accept escaped asterisks also mid-string and as only character.
> Especially the latter will help when translating from iptables where
> asterisk has no special meaning.

Fine with me, thanks.