netdev - Re: [PATCH net-next] netlink: specs: nftables: allow decode of default firewalld ruleset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m2ikve2v8z.fsf@gmail.com>
Date: Mon, 02 Sep 2024 11:41:16 +0100
From: Donald Hunter <donald.hunter@...il.com>
To: Florian Westphal <fw@...len.de>
Cc: <netdev@...r.kernel.org>,  netfilter-devel
 <netfilter-devel@...r.kernel.org>
Subject: Re: [PATCH net-next] netlink: specs: nftables: allow decode of
 default firewalld ruleset

Florian Westphal <fw@...len.de> writes:

> This update allows listing default firewalld ruleset on Fedora 40 via
>   tools/net/ynl/cli.py --spec \
>      Documentation/netlink/specs/nftables.yaml --dump getrule
>
> Default ruleset uses fib, reject and objref expressions which were
> missing.
>
> Other missing expressions can be added later.
>
> Improve decoding while at it:
> - add bitwise, ct and lookup attributes
> - wire up the quota expression
> - translate raw verdict codes to a human reable name, e.g.
>   'code': 4294967293 becomes 'code': 'jump'.
>
> Cc: Donald Hunter <donald.hunter@...il.com>
> Signed-off-by: Florian Westphal <fw@...len.de>

One minor question below, otherwise LGTM.

Reviewed-by: Donald Hunter <donald.hunter@...il.com>


> +    name: fib-result
> +    type: enum
> +    entries:
> +      - oif
> +      - oifname

Did you intentionally leave out addrtype from the enum?