From patchwork Mon Aug 9 19:42:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kyle Bowman X-Patchwork-Id: 1515178 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=cloudflare.com header.i=@cloudflare.com header.a=rsa-sha256 header.s=google header.b=woo8Wj3Q; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4Gk61z2mBHz9sX3 for ; Tue, 10 Aug 2021 05:43:03 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233845AbhHITnW (ORCPT ); Mon, 9 Aug 2021 15:43:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233165AbhHITnW (ORCPT ); Mon, 9 Aug 2021 15:43:22 -0400 Received: from mail-ot1-x334.google.com (mail-ot1-x334.google.com [IPv6:2607:f8b0:4864:20::334]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A08EC0613D3 for ; Mon, 9 Aug 2021 12:43:01 -0700 (PDT) Received: by mail-ot1-x334.google.com with SMTP id r19-20020a0568301353b029050aa53c3801so2315403otq.2 for ; Mon, 09 Aug 2021 12:43:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=STOp8ir3j8FvvY85GjngV72ujYxIdR3Wphh0OIgu/lE=; b=woo8Wj3Qu3rsOn87kw8N885CGUtvo7zFSzbq9MbirnQiab40hqt9fAfeehf4ihMq/Y B8SNYi5ejL1EqT+3ZY75GyDSxeHlXpJ/DW4bC+ogXBfy0r9Tp1ukxZJVVzBXlquRsJZV UVB5743G6WK8a8W0U1r9oHApKC83Y11XB6XrM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=STOp8ir3j8FvvY85GjngV72ujYxIdR3Wphh0OIgu/lE=; b=jPK8Ly44oUVfF5LYfRIWdD2g87hGcc8Icy6H9LD9W+SqCcqIlrqLvaDMrswvBGsu4m hXCp55vn2F62fhn0EXX0q+9uIy8nUpM26/QfiLzTmF5gpiuhn5e9frwOcJV+wleAXUQi KgjAo2G356IbZJ0nKhMTrgxFchsJymhpcQGdTkD6WSqP/9c1vQtCzWEA3oz8xw2MqswC 6jdi+0n/JjWmzfnURo9HMv31J8+bAZ/XMPVpLToQMeaEKk44fq71VT7r8xWHFOFCrSbK 5/XJojdH2E4qDxeLf61ZJm1tPs+ihGMsPFsi/J9poDmXJHsRugyZ1Rt+0Z5c5/5tVXKd ef/Q== X-Gm-Message-State: AOAM533i/UXqix46R08UMO2DkIgilPMrgUjjAIYDFk0UlSN42bf0ziyd orodhNdYHlsoWAmcafgdMYY6pNnXDsYzFw== X-Google-Smtp-Source: ABdhPJxAxk2cNM6P6bcaOMuXqAVjm2AXGw++mNqKQpcAnXrR0OA0O95q60E9YOU4MZvtj4hxhn0E/w== X-Received: by 2002:a05:6830:2a0b:: with SMTP id y11mr18601449otu.275.1628538180304; Mon, 09 Aug 2021 12:43:00 -0700 (PDT) Received: from localhost.localdomain (65-36-81-87.static.grandenetworks.net. [65.36.81.87]) by smtp.gmail.com with ESMTPSA id x60sm2647735ota.72.2021.08.09.12.42.59 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 09 Aug 2021 12:43:00 -0700 (PDT) From: Kyle Bowman To: netfilter-devel@vger.kernel.org Cc: kernel-team@cloudflare.com, Kyle Bowman , Alex Forster , Jeremy Sowden Subject: [PATCH 1/3] extensions: libtxt_NFLOG: use nft built-in logging instead of xt_NFLOG Date: Mon, 9 Aug 2021 14:42:41 -0500 Message-Id: <20210809194243.53370-1-kbowman@cloudflare.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Replaces the use of xt_NFLOG with the nft built-in log statement. This additionally adds support for using longer log prefixes of 128 characters in size. Until now NFLOG has truncated the log-prefix to the 64-character limit supported by iptables-legacy. We now use the struct xtables_target's udata member to store the longer 128-character prefix supported by iptables-nft. Signed-off-by: Kyle Bowman Signed-off-by: Alex Forster Signed-off-by: Jeremy Sowden --- extensions/libxt_NFLOG.c | 6 ++++++ iptables/nft.c | 28 ++++++++++++++++++++++++++++ iptables/nft.h | 1 + 3 files changed, 35 insertions(+) diff --git a/extensions/libxt_NFLOG.c b/extensions/libxt_NFLOG.c index 02a1b4aa..2b78e278 100644 --- a/extensions/libxt_NFLOG.c +++ b/extensions/libxt_NFLOG.c @@ -5,6 +5,7 @@ #include #include +#include #include #include @@ -53,12 +54,16 @@ static void NFLOG_init(struct xt_entry_target *t) static void NFLOG_parse(struct xt_option_call *cb) { + char *nf_log_prefix = cb->udata; + xtables_option_parse(cb); switch (cb->entry->id) { case O_PREFIX: if (strchr(cb->arg, '\n') != NULL) xtables_error(PARAMETER_PROBLEM, "Newlines not allowed in --log-prefix"); + + snprintf(nf_log_prefix, NF_LOG_PREFIXLEN, "%s", cb->arg); break; } } @@ -149,6 +154,7 @@ static struct xtables_target nflog_target = { .save = NFLOG_save, .x6_options = NFLOG_opts, .xlate = NFLOG_xlate, + .udata_size = NF_LOG_PREFIXLEN }; void _init(void) diff --git a/iptables/nft.c b/iptables/nft.c index 795dff86..aebbf674 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -39,6 +39,7 @@ #include #include +#include #include #include @@ -1340,6 +1341,8 @@ int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, ret = add_verdict(r, NF_DROP); else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0) ret = add_verdict(r, NFT_RETURN); + else if (strcmp(cs->jumpto, "NFLOG") == 0) + ret = add_log(r, cs); else ret = add_target(r, cs->target->t); } else if (strlen(cs->jumpto) > 0) { @@ -1352,6 +1355,31 @@ int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, return ret; } +int add_log(struct nftnl_rule *r, struct iptables_command_state *cs) +{ + struct nftnl_expr *expr; + struct xt_nflog_info *info = (struct xt_nflog_info *)cs->target->t->data; + + expr = nftnl_expr_alloc("log"); + if (!expr) + return -ENOMEM; + + if (info->prefix[0] != '\0') { + nftnl_expr_set_str(expr, NFTNL_EXPR_LOG_PREFIX, cs->target->udata); + } + + nftnl_expr_set_u16(expr, NFTNL_EXPR_LOG_GROUP, info->group); + if (info->flags & XT_NFLOG_F_COPY_LEN) + nftnl_expr_set_u32(expr, NFTNL_EXPR_LOG_SNAPLEN, + info->len); + if (info->threshold) + nftnl_expr_set_u16(expr, NFTNL_EXPR_LOG_QTHRESHOLD, + info->threshold); + + nftnl_rule_add_expr(r, expr); + return 0; +} + static void nft_rule_print_debug(struct nftnl_rule *r, struct nlmsghdr *nlh) { #ifdef NLDEBUG diff --git a/iptables/nft.h b/iptables/nft.h index 4ac7e009..28dc81b7 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -193,6 +193,7 @@ int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match int add_target(struct nftnl_rule *r, struct xt_entry_target *t); int add_jumpto(struct nftnl_rule *r, const char *name, int verdict); int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set); +int add_log(struct nftnl_rule *r, struct iptables_command_state *cs); char *get_comment(const void *data, uint32_t data_len); enum nft_rule_print { From patchwork Mon Aug 9 19:42:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kyle Bowman X-Patchwork-Id: 1515179 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=cloudflare.com header.i=@cloudflare.com header.a=rsa-sha256 header.s=google header.b=P3TtNaRV; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4Gk61z6317z9sX5 for ; Tue, 10 Aug 2021 05:43:03 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235137AbhHITnX (ORCPT ); Mon, 9 Aug 2021 15:43:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32808 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233165AbhHITnW (ORCPT ); Mon, 9 Aug 2021 15:43:22 -0400 Received: from mail-oi1-x229.google.com (mail-oi1-x229.google.com [IPv6:2607:f8b0:4864:20::229]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B898C0613D3 for ; Mon, 9 Aug 2021 12:43:02 -0700 (PDT) Received: by mail-oi1-x229.google.com with SMTP id be20so6308986oib.8 for ; Mon, 09 Aug 2021 12:43:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=SUSLvN3WOQnhf0N6IuDrTH8hp8qpgqCS3DeO0tKoMtk=; b=P3TtNaRVGdhN4DsMFJvmI222g1rIAOY6b9Iqs8n021ufiX/v2feyua7z443qtgMBJf +I5AhIQcydvVU/y7B3b5sMe/nV6RNUtEzi12j72uH8WSoqtyPoJhbMlYrTOGwY+wu7kd 8qmLFVYp5yZW6KHqoiGlCHEzYetbLzy06MVIw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=SUSLvN3WOQnhf0N6IuDrTH8hp8qpgqCS3DeO0tKoMtk=; b=eE903rkpBQOmwbMd/bRbd/vY5eCbUW/TyRteiDcQkYqIWzKFm6MwOiXWHdizekD0N1 bLTwDdGSZm7iQ539VZicgAKADL7PXTO45rPfinNJr9qZBxrolxmGeOP6K6sFU/DlRWJp xwHFyURX/6MNCkcjAwmYH4sglXJm5ObQHGAruSO7dpqzHhTxi8GMYQsERMIhJ/y6gkEk ScHlX4s0E7KFQLgm6Vbth6xFEgZd+1GwhFdioExNbZqySleYP+TlyE2UY/9ep2TPp3S2 PmCsv9KkTfotap7ZD/b43W1YXbV1eqsebnFfBgHYe9woV+7MyRNfEaGoRSKjtpotAvqM MSAg== X-Gm-Message-State: AOAM533pntD+XXIBESIdfEsZJTHBqucme5UBAsXpeNd8znQqi+4sF1TW l7aUklmpD0exo1cMe0SpI6n4YHeHlIZU2w== X-Google-Smtp-Source: ABdhPJz/RuUKFI0Tfn9cSNv+LXZKLb9Nyu0FzCiL+dCrjqBpLeaUKMz56bGgV7jn8Z6ZsACQrV+cyw== X-Received: by 2002:a05:6808:199a:: with SMTP id bj26mr5964510oib.91.1628538181195; Mon, 09 Aug 2021 12:43:01 -0700 (PDT) Received: from localhost.localdomain (65-36-81-87.static.grandenetworks.net. [65.36.81.87]) by smtp.gmail.com with ESMTPSA id x60sm2647735ota.72.2021.08.09.12.43.00 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 09 Aug 2021 12:43:00 -0700 (PDT) From: Kyle Bowman To: netfilter-devel@vger.kernel.org Cc: kernel-team@cloudflare.com, Kyle Bowman , Alex Forster , Jeremy Sowden Subject: [PATCH 2/3] extensions: libxt_NFLOG: dont truncate log prefix on print/save Date: Mon, 9 Aug 2021 14:42:42 -0500 Message-Id: <20210809194243.53370-2-kbowman@cloudflare.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210809194243.53370-1-kbowman@cloudflare.com> References: <20210809194243.53370-1-kbowman@cloudflare.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org When parsing the rule, use a struct with a layout compatible to that of struct xt_nflog_info, but with a buffer large enough to contain the whole 128-character nft prefix. We always send the nflog-group to the kernel since, for nft, log and nflog targets are handled by the same kernel module, and are distinguished by whether they define an nflog-group. Therefore, we must send the group even if it is zero, or the kernel will configure the target as a log, not an nflog. Changes to nft_is_expr_compatible were made since only targets which have an `nflog-group` are compatible. Since nflog targets are distinguished by having an nflog-group, we ignore targets without one. We also set the copy-len flag if the snap-len is set since without this, iptables will mistake `nflog-size` for `nflog-range`. Signed-off-by: Kyle Bowman Signed-off-by: Alex Forster Signed-off-by: Jeremy Sowden --- iptables/nft-shared.c | 58 +++++++++++++++++++++++++++++++++++++++++++ iptables/nft.c | 4 +++ 2 files changed, 62 insertions(+) diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c index 4253b081..c164d140 100644 --- a/iptables/nft-shared.c +++ b/iptables/nft-shared.c @@ -20,8 +20,10 @@ #include +#include #include #include +#include #include #include @@ -595,6 +597,60 @@ static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e) ctx->h->ops->parse_match(match, ctx->cs); } +static void nft_parse_log(struct nft_xt_ctx *ctx, struct nftnl_expr *e) +{ + struct xtables_target *target; + struct xt_entry_target *t; + size_t target_size; + /* + * In order to handle the longer log-prefix supported by nft, instead of + * using struct xt_nflog_info, we use a struct with a compatible layout, but + * a larger buffer for the prefix. + */ + struct xt_nflog_info_nft { + __u32 len; + __u16 group; + __u16 threshold; + __u16 flags; + __u16 pad; + char prefix[NF_LOG_PREFIXLEN]; + } info = { + .group = nftnl_expr_get_u16(e, NFTNL_EXPR_LOG_GROUP), + .threshold = nftnl_expr_get_u16(e, NFTNL_EXPR_LOG_QTHRESHOLD), + }; + if (nftnl_expr_is_set(e, NFTNL_EXPR_LOG_SNAPLEN)) { + info.len = nftnl_expr_get_u32(e, NFTNL_EXPR_LOG_SNAPLEN); + info.flags = XT_NFLOG_F_COPY_LEN; + } + if (nftnl_expr_is_set(e, NFTNL_EXPR_LOG_PREFIX)) { + snprintf(info.prefix, sizeof(info.prefix), "%s", + nftnl_expr_get_str(e, NFTNL_EXPR_LOG_PREFIX)); + } + + target = xtables_find_target("NFLOG", XTF_TRY_LOAD); + if (target == NULL) + return; + + target_size = XT_ALIGN(sizeof(struct xt_entry_target)) + + XT_ALIGN(sizeof(struct xt_nflog_info_nft)); + + t = xtables_calloc(1, target_size); + t->u.target_size = target_size; + strcpy(t->u.user.name, target->name); + t->u.user.revision = target->revision; + + target->t = t; + + struct xt_nflog_info *info = xtables_malloc(sizeof(struct xt_nflog_info)); + info->group = group; + info->len = snaplen; + info->threshold = qthreshold; + + memcpy(&target->t->data, &info, sizeof(info)); + + ctx->h->ops->parse_target(target, ctx->cs); +} + static void nft_parse_lookup(struct nft_xt_ctx *ctx, struct nft_handle *h, struct nftnl_expr *e) { @@ -644,6 +700,8 @@ void nft_rule_to_iptables_command_state(struct nft_handle *h, nft_parse_limit(&ctx, expr); else if (strcmp(name, "lookup") == 0) nft_parse_lookup(&ctx, h, expr); + else if (strcmp(name, "log") == 0) + nft_parse_log(&ctx, expr); expr = nftnl_expr_iter_next(iter); } diff --git a/iptables/nft.c b/iptables/nft.c index aebbf674..e9875f28 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -3515,6 +3515,10 @@ static int nft_is_expr_compatible(struct nftnl_expr *expr, void *data) nftnl_expr_get_u32(expr, NFTNL_EXPR_LIMIT_FLAGS) == 0) return 0; + if (!strcmp(name, "log") && + nftnl_expr_is_set(expr, NFTNL_EXPR_LOG_GROUP)) + return 0; + return -1; } From patchwork Mon Aug 9 19:42:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kyle Bowman X-Patchwork-Id: 1515180 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org (client-ip=23.128.96.18; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=cloudflare.com header.i=@cloudflare.com header.a=rsa-sha256 header.s=google header.b=dLrKpYqs; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by ozlabs.org (Postfix) with ESMTP id 4Gk6210PH3z9sX3 for ; Tue, 10 Aug 2021 05:43:05 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235350AbhHITnY (ORCPT ); Mon, 9 Aug 2021 15:43:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235230AbhHITnX (ORCPT ); Mon, 9 Aug 2021 15:43:23 -0400 Received: from mail-oi1-x22f.google.com (mail-oi1-x22f.google.com [IPv6:2607:f8b0:4864:20::22f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A4AD1C0613D3 for ; Mon, 9 Aug 2021 12:43:02 -0700 (PDT) Received: by mail-oi1-x22f.google.com with SMTP id t128so25218935oig.1 for ; Mon, 09 Aug 2021 12:43:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=x0ahJTKQXt56Pfan3cthP57Ez9jxZBk/5R/8y3923WM=; b=dLrKpYqsCYvNmQLE8X2dDMXFZKZ/b79ktwDFSIpsxp4WfnRTMJ+UhRInJM6Po61dBY BL0vi6YdaCCszfV7WWO5FRQGT7RKDMEnCCHXR/e87rNhq7FlaVq4J9Qj9DgiglWLR/xT 3iiNovy45b0tLvbuX8ypGvSu/6iV0EbsdrRJI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=x0ahJTKQXt56Pfan3cthP57Ez9jxZBk/5R/8y3923WM=; b=peZyAJ93zNmIaIIhPzM8PHr7eAmgrU6ZtsjU0aypJlCC38xY31Biaxbq01RzZuHA1o o43aoahV3W3HL7pPuCD27smEHxaCCj9aHzlOGEG20Ryxf/9f+/F3F6PzsDXoU5LYDE3g g29cQzzLhSP5bqIHZVhZhBK2i2cUcnJtIPisFLvqs4qhgs5QQ2J6fF2yB4m5g15wH4gk X6q9f4zQoaUJg7R7qetF/erZggoFfXKNdhw1LYEannt9QestXbaSAK9HyE6IB7t5FKcf lVa99PjdAVfTmEOSppA09G36gTgomOAroiFfi1TiCxzjiUaL3JWLvlITRU2YceJSOcid 39cA== X-Gm-Message-State: AOAM533trV1Goh1261LoafKj4XbEDU5xS9UDXBeYNObZcYsq2VyvCF62 Rg4uq6FC3Jumm0G+cpmenRX+AVpWmVFyfQ== X-Google-Smtp-Source: ABdhPJwDjLYqb8hwGjBxEVyWvQuFoy300f769AO52FgLlYtpvk+TKZ4Fz1ppTzMbbEPaWLcnr3fSQA== X-Received: by 2002:aca:1b08:: with SMTP id b8mr6208933oib.44.1628538181851; Mon, 09 Aug 2021 12:43:01 -0700 (PDT) Received: from localhost.localdomain (65-36-81-87.static.grandenetworks.net. [65.36.81.87]) by smtp.gmail.com with ESMTPSA id x60sm2647735ota.72.2021.08.09.12.43.01 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 09 Aug 2021 12:43:01 -0700 (PDT) From: Kyle Bowman To: netfilter-devel@vger.kernel.org Cc: kernel-team@cloudflare.com, Kyle Bowman , Alex Forster , Jeremy Sowden Subject: [PATCH 3/3] extensions: libxf_NFLOG: remove `--nflog-range` Python unit-tests. Date: Mon, 9 Aug 2021 14:42:43 -0500 Message-Id: <20210809194243.53370-3-kbowman@cloudflare.com> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210809194243.53370-1-kbowman@cloudflare.com> References: <20210809194243.53370-1-kbowman@cloudflare.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org nft has no equivalent to `--nflog-range`, so we cannot emulate it and the Python unit-tests for it fail. However, since `--nflog-range` is broken and doesn't do anything, the tests are not testing anything useful. Signed-off-by: Kyle Bowman Signed-off-by: Alex Forster Signed-off-by: Jeremy Sowden --- extensions/libxt_NFLOG.t | 4 ---- 1 file changed, 4 deletions(-) diff --git a/extensions/libxt_NFLOG.t b/extensions/libxt_NFLOG.t index 933fa221..33a15c06 100644 --- a/extensions/libxt_NFLOG.t +++ b/extensions/libxt_NFLOG.t @@ -3,10 +3,6 @@ -j NFLOG --nflog-group 65535;=;OK -j NFLOG --nflog-group 65536;;FAIL -j NFLOG --nflog-group 0;-j NFLOG;OK --j NFLOG --nflog-range 1;=;OK --j NFLOG --nflog-range 4294967295;=;OK --j NFLOG --nflog-range 4294967296;;FAIL --j NFLOG --nflog-range -1;;FAIL -j NFLOG --nflog-size 0;=;OK -j NFLOG --nflog-size 1;=;OK -j NFLOG --nflog-size 4294967295;=;OK