Bug 1571938 - nftables: man page gives wrong keyword for "reject with icmp6"
Summary: nftables: man page gives wrong keyword for "reject with icmp6"
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nftables
Version: 7.6
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Phil Sutter
QA Contact: Jiri Peska
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-25 18:32 UTC by Eric Garver
Modified: 2018-10-30 10:38 UTC (History)
2 users (show)

Fixed In Version: nftables-0.8-9.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:38:13 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3154 0 None None None 2018-10-30 10:38:36 UTC

Description Eric Garver 2018-04-25 18:32:49 UTC
The keyword that nft actually accepts is "icmpv6".
e.g.

# nft add table inet firewalld
[root@dev-rhel7 firewalld]# nft add chain inet firewalld blah { type filter hook input priority 0 \; }
[root@dev-rhel7 firewalld]# nft add rule inet firewalld blah meta nfproto ipv6 reject with icmp6 type admin-prohibited
Error: syntax error, unexpected string, expecting icmp or icmpv6 or tcp or icmpx
add rule inet firewalld blah meta nfproto ipv6 reject with icmp6 type admin-prohibited
                                                           ^^^^^
[root@dev-rhel7 firewalld]# nft add rule inet firewalld blah meta nfproto ipv6 reject with icmpv6 type admin-prohibited



$ man nft
...
   REJECT STATEMENT
       reject [ with {icmp | icmp6 | icmpx} type {icmp_type | icmp6_type | icmpx_type} ]
       reject [ with {tcp} {reset} ]

Comment 2 Phil Sutter 2018-06-06 09:00:40 UTC
Fix submitted upstream: https://marc.info/?l=netfilter-devel&m=152827540006707&w=2

Comment 3 Phil Sutter 2018-06-06 10:57:16 UTC
Upstream accepted:

commit 9b3036bb9f00d6e244ed92e0e782c5617ae40b84 (origin/master, origin/HEAD)
Author: Phil Sutter <phil@nwl.cc>
Date:   Wed Jun 6 10:56:26 2018 +0200

    nft.8: Fix reject statement documentation
    
    First of all, 'with icmp6' is invalid, expected is 'with icmpv6'. In
    addition to that, parameter 'type' expects an icmp*_code type, not
    icmp*_type. The respective table column was already correct, but in
    synopsis it was wrong.
    
    Signed-off-by: Phil Sutter <phil@nwl.cc>
    Signed-off-by: Florian Westphal <fw@strlen.de>

Comment 8 errata-xmlrpc 2018-10-30 10:38:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3154


Note You need to log in before you can comment on or make changes to this bug.