[PATCH nft] doc: statements: fwd supports for sending packets via neighbouring layer

[PATCH nft] doc: statements: fwd supports for sending packets via neighbouring layer

[Pablo Neira Ayuso]

Document ability to forward packets through neighbour layer added in
30d45266bf38 ("expr: extend fwd statement to support address and family").

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 doc/statements.txt | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/statements.txt b/doc/statements.txt
index 8076c21cded4..66877eac847b 100644
--- a/doc/statements.txt
+++ b/doc/statements.txt
@@ -683,7 +683,25 @@ The fwd statement is used to redirect a raw packet to another interface. It is
 only available in the netdev family ingress and egress hooks. It is similar to
 the dup statement except that no copy is made.
 
+You can also specify the address of the next hop and the device to forward the
+packet to. This updates the source and destination MAC address of the packet by
+transmitting it through the neighboring Layer 2 layer. This also decrements the
+ttl field of the IP packet. This provides a way to effectively bypass the
+classical forwarding path, thus skipping the fib (forwarding information base)
+lookup.
+
+[verse]
 *fwd to* 'device'
+*fwd* [*ip* | *ip6*] *to* 'address' *device* 'device'
+
+.Using the fwd statement
+------------------------
+# redirect raw packet to device
+netdev ingress fwd to "eth0"
+
+# forward packet to next hop 192.168.200.1 via eth0 device
+netdev ingress ether saddr set fwd ip to 192.168.200.1 device "eth0"
+-----------------------------------
 
 SET STATEMENT
 ~~~~~~~~~~~~~
-- 
2.30.2

[PATCH nft] scanner: munch full comment lines

[Pablo Neira Ayuso]

Munch lines full comment lines, regular expression matches lines that
start by space or tab, then # follows, finally anything including one
single line break.

Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1196
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/scanner.l                                 |  2 ++
 tests/shell/testcases/comments/comments_0     | 20 +++++++++++++++++++
 .../testcases/comments/dumps/comments_0.nft   |  6 ++++++
 3 files changed, 28 insertions(+)
 create mode 100755 tests/shell/testcases/comments/comments_0
 create mode 100644 tests/shell/testcases/comments/dumps/comments_0.nft

diff --git a/src/scanner.l b/src/scanner.l
index 1371cd044b65..ec9df5c2af9f 100644
--- a/src/scanner.l
+++ b/src/scanner.l
@@ -124,6 +124,7 @@ string		({letter}|[_.])({letter}|{digit}|[/\-_\.])*
 quotedstring	\"[^"]*\"
 asteriskstring	({string}\*|{string}\\\*|\\\*|{string}\\\*{string})
 comment		#.*$
+comment_line	^[ \t]*#.*\n
 slash		\/
 
 timestring	([0-9]+d)?([0-9]+h)?([0-9]+m)?([0-9]+s)?([0-9]+ms)?
@@ -858,6 +859,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 {tab}+
 {space}+
 {comment}
+{comment_line}
 
 <<EOF>> 		{
 				update_pos(yyget_extra(yyscanner), yylloc, 1);
diff --git a/tests/shell/testcases/comments/comments_0 b/tests/shell/testcases/comments/comments_0
new file mode 100755
index 000000000000..843927f18232
--- /dev/null
+++ b/tests/shell/testcases/comments/comments_0
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+RULESET="table ip x {		# comment
+        # comment 1
+	# comment 2
+	set y { # comment here
+		type ipv4_addr	# comment
+		elements = {
+			# 1.1.1.1
+                        2.2.2.2, # comment
+                        # more comments
+                        3.3.3.3,	# comment
+                }
+		# comment
+        }
+}
+"
+
+$NFT -f - <<< "$RULESET"
+
diff --git a/tests/shell/testcases/comments/dumps/comments_0.nft b/tests/shell/testcases/comments/dumps/comments_0.nft
new file mode 100644
index 000000000000..3507e0b1d198
--- /dev/null
+++ b/tests/shell/testcases/comments/dumps/comments_0.nft
@@ -0,0 +1,6 @@
+table ip x {
+	set y {
+		type ipv4_addr
+		elements = { 2.2.2.2, 3.3.3.3 }
+	}
+}
-- 
2.30.2