This extends linftnl/nftables to indicate incomplete expressions/sets.
When using old nft binary that cannot list a new expression, nft already
prints an error with the name of the unknown expression.
Extend libnftnl to also make an annotation when a known expression has
an unknown attribute included in the dump, then extend nftables to also
display this to the user.
Debug out out will include the [incomplete] tag for each affected
expression.
Nftables will append '"# Unknown features used (old nft version?)"'
comment to the rule resp. the set defintion.
I added new APIs because existing nftnl_expr_get() can't be re-used,
inserting a new common attribute like NFTNL_EXPR_COMPLETE will break ABI.
It would make sense to also add
nftnl_XXX_complete functions for table, chains, objects and flowtables so we
have coverage for all supported types in one go, but I think its better
to first check for feedback before doing this.
libnftnl:
Florian Westphal (3):
expr: add and use incomplete tag
sets: add and use incomplete tag
libnftnl: add api to query dissection state
include/data_reg.h | 1 +
include/expr.h | 1 +
include/libnftnl/expr.h | 2 ++
include/libnftnl/set.h | 1 +
include/set.h | 1 +
src/expr.c | 6 ++++++
src/expr/bitwise.c | 8 +++++---
src/expr/byteorder.c | 9 ++++++---
src/expr/cmp.c | 9 ++++++---
src/expr/connlimit.c | 9 ++++++---
src/expr/counter.c | 9 ++++++---
src/expr/ct.c | 9 ++++++---
src/expr/data_reg.c | 19 +++++++++++++------
src/expr/dup.c | 9 ++++++---
src/expr/dynset.c | 9 ++++++---
src/expr/exthdr.c | 8 +++++---
src/expr/fib.c | 9 ++++++---
src/expr/flow_offload.c | 9 ++++++---
src/expr/fwd.c | 8 +++++---
src/expr/hash.c | 8 +++++---
src/expr/immediate.c | 8 +++++---
src/expr/inner.c | 8 +++++---
src/expr/last.c | 8 +++++---
src/expr/limit.c | 8 +++++---
src/expr/log.c | 8 +++++---
src/expr/lookup.c | 8 +++++---
src/expr/masq.c | 8 +++++---
src/expr/match.c | 8 +++++---
src/expr/meta.c | 6 ++++++
src/expr/nat.c | 8 +++++---
src/expr/numgen.c | 8 +++++---
src/expr/objref.c | 8 +++++---
src/expr/osf.c | 9 +++++----
src/expr/payload.c | 8 +++++---
src/expr/queue.c | 9 ++++++---
src/expr/quota.c | 8 +++++---
src/expr/range.c | 8 +++++---
src/expr/redir.c | 8 +++++---
src/expr/reject.c | 9 ++++++---
src/expr/rt.c | 9 ++++++---
src/expr/socket.c | 9 ++++++---
src/expr/synproxy.c | 16 ++++++++--------
src/expr/target.c | 9 ++++++---
src/expr/tproxy.c | 8 +++++---
src/expr/tunnel.c | 8 +++++---
src/expr/xfrm.c | 8 +++++---
src/libnftnl.map | 5 +++++
src/rule.c | 5 +++++
src/set.c | 6 ++++++
src/set_elem.c | 5 +++++
50 files changed, 259 insertions(+), 126 deletions(-)
nft:
Florian Westphal (2):
netlink: tell user if libnftnl detected unknown attributes/features
sets: inform user when set definition contains unknown attributes
include/netlink.h | 1 +
include/rule.h | 2 ++
src/netlink.c | 3 +++
src/netlink_delinearize.c | 24 ++++++++++++++++++++++++
src/rule.c | 5 +++++
5 files changed, 35 insertions(+)
--
2.45.2
