Hi!
 
The Netfilter project proudly presents:
 
        nftables 1.1.7
 
This release contains mostly fixes but also new features:
 
- Fix spurious EEXIST error when using the create element command with
  large batches. Distributors offering binaries for versions > 1.1.2
  and <= 1.1.6 are encouraged to cherry-pick this fix:
 
    e83e32c8d1cd ("mnl: restore create element command with large batches").
 
- Improve error reporting for syntax errors by printing expected
  tokens:
 
    # nft add rule ip x y limit
    Error: syntax error, unexpected newline
    expected any of: name, rate
    add rule ip x y limit
 
  This requires bison >= 3.6.
 
- add/insert commands use 'handle' for positioning in JSON. The handle
  specifies from what rule to add (after the specified rule) or insert
  (before the specified rule). Multiple rules added at the same handle
  are positioned relative to the original rule, not to previously
  inserted rules.

{
  "nftables": [
    {
      "add": {
        "rule": {
          "family": "inet",
          "table": "test",
          "chain": "c",
          "handle": 10,    <----- this adds after rule with handle 10
          "expr": [
            {
              "match": {
                "op": "==",
                "left": {
                  "payload": {
                    "protocol": "tcp",
                    "field": "dport"
                  }
                },
                "right": 443
              }
            },
            {
              "accept": null
            }
          ]
        }
      }
    }
  ]
}
 
- Sort strings datatype when listing sets:
 
        ifname { "abcdef0", "eth0" } counter packets 0 bytes 0
 
- Sort concatenation components in big endian, so the listing is
  independent of the architecture byteorder.

- Update --debug=netlink to display data in its byteorder and size,
  this applies to immediate data in expressions and set elements.
 
   # nft --debug=netlink add rule x y tcp dport 22 counter
   ip x y
     [ meta load l4proto => reg 1 ]
     [ cmp eq reg 1 0x06 ]
     [ payload load 2b @ transport header + 2 => reg 1 ]
     [ cmp eq reg 1 0x0016 ]
     [ counter pkts 0 bytes 0 ]
 
  This requires libnftnl >= 1.3.2.
 
- Add --enable-profiling option for ./configure. This sets on
  the --coverage compiler flag so code coverage may be inspected
  using gcov.
 
- Set element support for multi-statements, eg. counter + quota.
 
   ...
   {
    "elem": {
      "val": "2.2.2.2",
      "counter": {
        "packets": 0,
        "bytes": 0
      },
      "quota": {
        "val": 1000,
        "val_unit": "bytes"
      }
    }
   }
 
  You can also combine with ct count, last and limit rate.

- Connlimit support with maps.
 
   table ip x {
        ct count connlimit1 {
                over 2
        }
        ct count connlimit2 {
                over 10
        }
 
        chain y {
                type filter hook input priority filter; policy accept;
                ct count name tcp dport map { 22 : "connlimit1", 80 : "connlimit2" } counter drop
        }
   }


- Include "count" field when listing set in JSON.
 
   ...
   {
      "set": {
        "family": "ip",
        "name": "y",
        "table": "x",
        "type": {
          "typeof": {
            "payload": {
              "protocol": "tcp",
              "field": "dport"
            }
          }
        },
        "handle": 1,
        "size": 10,
        "count": 3,    <--- because "size" is present, display "count"
        "elem": [
          1,
          30,
          50
        ]
      }
   }

- Support for using bitmask datatypes as set key, eg. tcp flags.
 
   table ip x {
        map y {
                typeof tcp flags : verdict
                flags interval
                elements = { syn | ack : accept,
                             ack : drop,
                             rst : drop,
                             0x20-0xff : drop,
               }
        }
 
        set s {
                typeof tcp flags
                flags interval
                elements = { syn | ack,
                             ack,
                             rst,
                             0x20-0xff,
               }
        }
 
 
        chain z {
                tcp flags vmap @y
                tcp flags vmap { syn | ack : accept, ack : drop, rst : drop, 0x20-0xff : drop }
                tcp flags @s
                tcp flags { syn | ack, ack, rst, 0x20-0xff }
        }
   }

- Fix element deletion by numeric cgroupsv2 id.
 
   # nft list set ip t s
   table ip t {
           set s {
                  type cgroupsv2
                  elements = { 50834 }
           }
   }
   # nft delete element ip t s { 50834 }
 
- Fix get element with intervals including maximum datatype value,
  eg. interval with 65535, ie. maximum value for typeof tcp dport.
 
   # nft get element ip x y { 65531 }
   table ip x {
        set y {
                type inet_service
                flags interval
                elements = { 65530-65535 }
        }
   }
   # nft get element ip x y { 65535 }
   table ip x {
        set y {
                type inet_service
                flags interval
                elements = { 65530-65535 }
        }
   }
 
- Use poll() not select(), otherwise libnftables breaks with
  third party applications with >= 1024 open file descriptors.
 
- Do not reset counter if -c/--check is specified with the reset
  command.
    
   # nft -c reset rules ip x

- Replace strings by tokens in the parser, leverage Flex start
  conditions for this purpose.
 
- Many tests coverage enhacements.
 
... and man nft(8) documentation updates and assorted fixes.
 
See changelog for more details (attached to this email).
 
You can download this new release from:
 
https://www.netfilter.org/projects/nftables/downloads.html
https://www.netfilter.org/pub/nftables/
 
To build the code, libnftnl >= 1.3.2 and libmnl >= 1.0.4 are required:
 
* https://netfilter.org/projects/libnftnl/index.html
* https://netfilter.org/projects/libmnl/index.html
 
Visit our wikipage for user documentation at:
 
* https://wiki.nftables.org
 
For the manpage reference, check man(8) nft.
 
In case of bugs and feature requests, file them via:
 
* https://bugzilla.netfilter.org
 
Happy firewalling.