Netfilter Tables userspace utillites
63fbb66589
* Tue Jun 30 2026 Phil Sutter <psutter@redhat.com> [1.0.9-8.el9]
- parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-190549]
- parser_json: bail out on malformed statement in set (Phil Sutter) [RHEL-190549]
- parser_json: allow statement stateful statement only in set elements (Phil Sutter) [RHEL-190549]
- parser_json: fix crash in json_parse_set_stmt_list (Phil Sutter) [RHEL-190549]
- cache: honor -c/--check for reset commands (Phil Sutter) [RHEL-190549]
- mnl: Fix ordering of hooks in 'list hooks' output (Phil Sutter) [RHEL-190549]
- segtree: Fix for variable-sized object may not be initialized (Phil Sutter) [RHEL-190549]
- cache: Filter for table when listing flowtables (Phil Sutter) [RHEL-190549]
- cache: Filter for table when listing sets or maps (Phil Sutter) [RHEL-190549]
- cache: Relax chain_cache_dump filter application (Phil Sutter) [RHEL-190549]
- cache: Respect family in all list commands (Phil Sutter) [RHEL-190549]
- json: complete multi-statement set element support (Phil Sutter) [RHEL-190549]
- mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-190549]
- optimize: expand expression list when merging into concatenation (Phil Sutter) [RHEL-190549]
- mergesort: Fix sorting of string values (Phil Sutter) [RHEL-190549]
- segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-190549]
- monitor: fix memleak in setelem cb (Phil Sutter) [RHEL-190549]
- tests: json_echo: Drop rule handle before multi-add (Phil Sutter) [RHEL-190549]
- rule: skip CMD_OBJ_SETELEMS with no elements after set flush (Phil Sutter) [RHEL-190549]
- doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-190549]
- doc: don't suggest to disable GSO (Phil Sutter) [RHEL-190549]
- tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-190549]
- tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-190549]
- optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-190549]
- datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-190549]
- datatype: clamp boolean value to 0 and 1 (Phil Sutter) [RHEL-190549]
- src: parser_json: fix format string bugs (Phil Sutter) [RHEL-190549]
- doc: fix tcpdump example (Phil Sutter) [RHEL-190549]
- fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-190549]
- monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-190549]
- tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-190549]
- monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-190549]
- mnl: continue on ENOBUFS errors when processing batch (Phil Sutter) [RHEL-190549]
- mnl: silence compiler warning (Phil Sutter) [RHEL-190549]
- fib: restore JSON output for relational expressions (Phil Sutter) [RHEL-190549]
- json: Do not reduce single-item arrays on output (Phil Sutter) [RHEL-190549]
- src: ensure chain policy evaluation when specified (Phil Sutter) [RHEL-190549]
- segtree: incorrect type when aggregating concatenated set ranges (Phil Sutter) [RHEL-190549]
- tests: py: Fix tests added for 'icmpv6 taddr' support (Phil Sutter) [RHEL-190549]
- tests: py: Drop stale entry from ip/snat.t.payload (Phil Sutter) [RHEL-190549]
- tests: py: Drop stale entries from ip6/{ct,meta}.t.json (Phil Sutter) [RHEL-190549]
- tests: py: Drop stale entry from ip/snat.t.json (Phil Sutter) [RHEL-190549]
- tests: py: Drop duplicate test from inet/vxlan.t (Phil Sutter) [RHEL-190549]
- tests: py: Drop stale entry from inet/tcp.t.json (Phil Sutter) [RHEL-190549]
- tests: py: Drop duplicate test from inet/gretap.t (Phil Sutter) [RHEL-190549]
- tests: py: Drop duplicate test from inet/gre.t (Phil Sutter) [RHEL-190549]
- tests: py: Drop duplicate test from inet/geneve.t (Phil Sutter) [RHEL-190549]
- tests: py: Drop stale entries since redundant test case removal (Phil Sutter) [RHEL-190549]
- src: netlink: netlink_delinearize_table() may return NULL (Phil Sutter) [RHEL-190549]
- doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-190549]
- mnl: Call mnl_attr_nest_end() just once (Phil Sutter) [RHEL-190549]
- evaluate: validate set expression type before accessing flags (Phil Sutter) [RHEL-190549]
- rule: print chain and flowtable devices in quotes (Phil Sutter) [RHEL-190549]
- tests: shell: skip if kernel does not support flowtable counter (Phil Sutter) [RHEL-190549]
- tests: shell: adjust add-after-delete flowtable for older kernels (Phil Sutter) [RHEL-190549]
- tests/shell: cover long interface name in "0042chain_variable_0" test (Phil Sutter) [RHEL-190549]
- tests: py: re-enables nft-test.py to load the local nftables.py (Phil Sutter) [RHEL-190549]
- fib: allow to use it in set statements (Phil Sutter) [RHEL-190549]
- fib: allow to check if route exists in maps (Phil Sutter) [RHEL-190549]
- tests: py: fix json single-flag output for fib & synproxy (Phil Sutter) [RHEL-190549]
- parser_json: Introduce parse_flags_array() (Phil Sutter) [RHEL-190549]
- json: work around fuzzer-induced assert crashes (Phil Sutter) [RHEL-190549]
- json: Introduce json_add_array_new() (Phil Sutter) [RHEL-190549]
- json: Print single synproxy flags as non-array (Phil Sutter) [RHEL-190549]
- json: Print single fib flag as non-array (Phil Sutter) [RHEL-190549]
- json: fix use after free in table_flags_json() (Phil Sutter) [RHEL-190549]
- doc: extend description of fib expression (Phil Sutter) [RHEL-190549]
- json: reject too long interface names (Phil Sutter) [RHEL-190549]
- parser_bison: allow delete command with map via handle (Phil Sutter) [RHEL-190549]
- parser_bison: only reset by name is supported by now (Phil Sutter) [RHEL-190549]
- cache: assert name is non-nul when looking up (Phil Sutter) [RHEL-190549]
- rule: skip fuzzy lookup if object name is not available (Phil Sutter) [RHEL-190549]
- src: BASECHAIN flag no longer implies presence of priority expression (Phil Sutter) [RHEL-190549]
- netlink: Avoid crash upon missing NFTNL_OBJ_CT_TIMEOUT_ARRAY attribute (Phil Sutter) [RHEL-190549]
- tests: py: Properly fix JSON equivalents for netdev/reject.t (Phil Sutter) [RHEL-190549]
- tests: monitor: Fix for single flag array avoidance (Phil Sutter) [RHEL-190549]
- json: Support typeof in set and map types (Phil Sutter) [RHEL-190549]
- netlink: Do not allocate a bogus flowtable priority expr (Phil Sutter) [RHEL-190549]
- netlink: Fix for potential crash parsing a flowtable (Phil Sutter) [RHEL-190549]
- json: prevent null deref if chain->policy is not set (Phil Sutter) [RHEL-190549]
- netlink: Catch unknown types when deserializing objects (Phil Sutter) [RHEL-190549]
- netlink: Avoid potential NULL-ptr deref parsing set elem expressions (Phil Sutter) [RHEL-190549]
- json: Print single set flag as non-array (Phil Sutter) [RHEL-190549]
- doc: Fix typo in nat statement 'prefix' description (Phil Sutter) [RHEL-190549]
Resolves: RHEL-190549
|
||
|---|---|---|
| .fmf | ||
| plans | ||
| .gitignore | ||
| 0001-Add-support-for-table-s-persist-flag.patch | ||
| 0002-cache-Always-set-NFT_CACHE_TERSE-for-list-cmd-with-t.patch | ||
| 0003-json-deal-appropriately-with-multidevice-in-chain.patch | ||
| 0004-parser_json-fix-handle-memleak-from-error-path.patch | ||
| 0005-tests-shell-Fix-sets-reset_command_0-for-current-ker.patch | ||
| 0006-tests-shell-connect-chains-to-hook-point.patch | ||
| 0007-datatype-rt_symbol_table_init-to-search-for-iproute2.patch | ||
| 0008-tests-py-remove-huge-limit-test-cases.patch | ||
| 0009-tests-py-add-missing-json.output-data.patch | ||
| 0010-tests-py-missing-json-output-in-never-merge-across-n.patch | ||
| 0011-Revert-doc-part-of-src-add-tcp-option-reset-support.patch | ||
| 0012-Revert-doc-part-of-meta-introduce-meta-broute-suppor.patch | ||
| 0013-Revert-doc-part-of-exthdr-add-boolean-DCCP-option-ma.patch | ||
| 0014-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch | ||
| 0015-src-fix-reset-element-support-for-interval-set-type.patch | ||
| 0016-doc-Fix-typo-in-nat-statement-prefix-description.patch | ||
| 0017-json-Print-single-set-flag-as-non-array.patch | ||
| 0018-netlink-Avoid-potential-NULL-ptr-deref-parsing-set-e.patch | ||
| 0019-netlink-Catch-unknown-types-when-deserializing-objec.patch | ||
| 0020-json-prevent-null-deref-if-chain-policy-is-not-set.patch | ||
| 0021-netlink-Fix-for-potential-crash-parsing-a-flowtable.patch | ||
| 0022-netlink-Do-not-allocate-a-bogus-flowtable-priority-e.patch | ||
| 0023-json-Support-typeof-in-set-and-map-types.patch | ||
| 0024-tests-monitor-Fix-for-single-flag-array-avoidance.patch | ||
| 0025-tests-py-Properly-fix-JSON-equivalents-for-netdev-re.patch | ||
| 0026-netlink-Avoid-crash-upon-missing-NFTNL_OBJ_CT_TIMEOU.patch | ||
| 0027-src-BASECHAIN-flag-no-longer-implies-presence-of-pri.patch | ||
| 0028-rule-skip-fuzzy-lookup-if-object-name-is-not-availab.patch | ||
| 0029-cache-assert-name-is-non-nul-when-looking-up.patch | ||
| 0030-parser_bison-only-reset-by-name-is-supported-by-now.patch | ||
| 0031-parser_bison-allow-delete-command-with-map-via-handl.patch | ||
| 0032-json-reject-too-long-interface-names.patch | ||
| 0033-doc-extend-description-of-fib-expression.patch | ||
| 0034-json-fix-use-after-free-in-table_flags_json.patch | ||
| 0035-json-Print-single-fib-flag-as-non-array.patch | ||
| 0036-json-Print-single-synproxy-flags-as-non-array.patch | ||
| 0037-json-Introduce-json_add_array_new.patch | ||
| 0038-json-work-around-fuzzer-induced-assert-crashes.patch | ||
| 0039-parser_json-Introduce-parse_flags_array.patch | ||
| 0040-tests-py-fix-json-single-flag-output-for-fib-synprox.patch | ||
| 0041-fib-allow-to-check-if-route-exists-in-maps.patch | ||
| 0042-fib-allow-to-use-it-in-set-statements.patch | ||
| 0043-tests-py-re-enables-nft-test.py-to-load-the-local-nf.patch | ||
| 0044-tests-shell-cover-long-interface-name-in-0042chain_v.patch | ||
| 0045-tests-shell-adjust-add-after-delete-flowtable-for-ol.patch | ||
| 0046-tests-shell-skip-if-kernel-does-not-support-flowtabl.patch | ||
| 0047-rule-print-chain-and-flowtable-devices-in-quotes.patch | ||
| 0048-evaluate-validate-set-expression-type-before-accessi.patch | ||
| 0049-mnl-Call-mnl_attr_nest_end-just-once.patch | ||
| 0050-doc-nft.8-Minor-NAT-STATEMENTS-section-review.patch | ||
| 0051-src-netlink-netlink_delinearize_table-may-return-NUL.patch | ||
| 0052-tests-py-Drop-stale-entries-since-redundant-test-cas.patch | ||
| 0053-tests-py-Drop-duplicate-test-from-inet-geneve.t.patch | ||
| 0054-tests-py-Drop-duplicate-test-from-inet-gre.t.patch | ||
| 0055-tests-py-Drop-duplicate-test-from-inet-gretap.t.patch | ||
| 0056-tests-py-Drop-stale-entry-from-inet-tcp.t.json.patch | ||
| 0057-tests-py-Drop-duplicate-test-from-inet-vxlan.t.patch | ||
| 0058-tests-py-Drop-stale-entry-from-ip-snat.t.json.patch | ||
| 0059-tests-py-Drop-stale-entries-from-ip6-ct-meta-.t.json.patch | ||
| 0060-tests-py-Drop-stale-entry-from-ip-snat.t.payload.patch | ||
| 0061-tests-py-Fix-tests-added-for-icmpv6-taddr-support.patch | ||
| 0062-segtree-incorrect-type-when-aggregating-concatenated.patch | ||
| 0063-src-ensure-chain-policy-evaluation-when-specified.patch | ||
| 0064-json-Do-not-reduce-single-item-arrays-on-output.patch | ||
| 0065-fib-restore-JSON-output-for-relational-expressions.patch | ||
| 0066-mnl-silence-compiler-warning.patch | ||
| 0067-mnl-continue-on-ENOBUFS-errors-when-processing-batch.patch | ||
| 0068-monitor-Quote-device-names-in-chain-declarations-too.patch | ||
| 0069-tests-monitor-Fix-regex-collecting-expected-echo-out.patch | ||
| 0070-monitor-Inform-JSON-printer-when-reporting-an-object.patch | ||
| 0071-fib-Fix-for-existence-check-on-Big-Endian.patch | ||
| 0072-doc-fix-tcpdump-example.patch | ||
| 0073-src-parser_json-fix-format-string-bugs.patch | ||
| 0074-datatype-clamp-boolean-value-to-0-and-1.patch | ||
| 0075-datatype-Fix-boolean-type-on-Big-Endian.patch | ||
| 0076-optimize-Fix-verdict-expression-comparison.patch | ||
| 0077-tests-py-any-ct.t.json.output-Drop-leftover-entry.patch | ||
| 0078-tests-py-inet-osf.t-Fix-element-ordering-in-JSON-equ.patch | ||
| 0079-doc-don-t-suggest-to-disable-GSO.patch | ||
| 0080-doc-libnftables-json-Describe-RULESET-object.patch | ||
| 0081-rule-skip-CMD_OBJ_SETELEMS-with-no-elements-after-se.patch | ||
| 0082-tests-json_echo-Drop-rule-handle-before-multi-add.patch | ||
| 0083-monitor-fix-memleak-in-setelem-cb.patch | ||
| 0084-segtree-Fix-range-aggregation-on-Big-Endian.patch | ||
| 0085-mergesort-Fix-sorting-of-string-values.patch | ||
| 0086-optimize-expand-expression-list-when-merging-into-co.patch | ||
| 0087-mergesort-Align-concatenation-sort-order-with-Big-En.patch | ||
| 0088-json-complete-multi-statement-set-element-support.patch | ||
| 0089-cache-Respect-family-in-all-list-commands.patch | ||
| 0090-cache-Relax-chain_cache_dump-filter-application.patch | ||
| 0091-cache-Filter-for-table-when-listing-sets-or-maps.patch | ||
| 0092-cache-Filter-for-table-when-listing-flowtables.patch | ||
| 0093-segtree-Fix-for-variable-sized-object-may-not-be-ini.patch | ||
| 0094-mnl-Fix-ordering-of-hooks-in-list-hooks-output.patch | ||
| 0095-cache-honor-c-check-for-reset-commands.patch | ||
| 0096-parser_json-fix-crash-in-json_parse_set_stmt_list.patch | ||
| 0097-parser_json-allow-statement-stateful-statement-only-.patch | ||
| 0098-parser_json-bail-out-on-malformed-statement-in-set.patch | ||
| 0099-parser_json-fix-map-set-type-confusion-crash-in-map-.patch | ||
| gating.yaml | ||
| main.nft | ||
| nat.nft | ||
| nft-test.stderr.expect | ||
| nftables.conf | ||
| nftables.service | ||
| nftables.spec | ||
| router.nft | ||
| rpminspect.yaml | ||
| run-tests.stderr.expect | ||
| sources | ||