Hi,
Looks like secmark support is broken:
| # nft add table t
| # nft add chain t c
| # nft add secmark t ssh \"system_u:object_r:ssh_server_packet_t:s0\"
| # nft add rule t c tcp dport 22 meta secmark set ssh
| # nft list ruleset
| table ip t {
| secmark ssh {
| "system_u:object_r:ssh_server_packet_t:s0"
| }
|
| chain c {
| tcp dport 22 secmark name "ssh"
| }
| }
| # nft list ruleset >/tmp/nft.dump
| # nft -f /tmp/nft.dump
| /tmp/nft.dump:7:16-22: Error: syntax error, unexpected secmark, expecting newline or semicolon
| tcp dport 22 secmark name "ssh"
| ^^^^^^^
Output should ideally match input or at least be accepted by nft when
fed back. Could you please have a look?
Apart from the above, this should be documented in nft.8 and
libnftables-json.5. Adding a test would help as well, at least in
tests/shell. AFAICT, integration into tests/py might be more work since
this thing does not support anonymous secmark objects, right?
Thanks, Phil
