From ea57cdf1c7baa7b2d428fe9e0fb8c23cd21bb705 Mon Sep 17 00:00:00 2001 From: Cory Snider Date: Tue, 14 Jul 2026 10:46:24 -0400 Subject: [PATCH] d/libn/i/nftables: add trailing semicolon The syntax for specifying the parameters of a base chain is documented to have a mandatory semicolon terminating each parameter clause. In practice, nft sometimes accepts a chain definition with a newline instead of a semicolon after the terminal parameter, only to reject the rules that follow with strange errors. Add trailing semicolons to the policy parameters of base chain definitions to satisfy the parsers of all versions of nft we might encounter. Signed-off-by: Cory Snider --- .../internal/nftables/incremental_update.nft.gotmpl | 4 ++-- daemon/libnetwork/internal/nftables/reload.nft.gotmpl | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/daemon/libnetwork/internal/nftables/incremental_update.nft.gotmpl b/daemon/libnetwork/internal/nftables/incremental_update.nft.gotmpl index 98c53240aa..e32d85cbec 100644 --- a/daemon/libnetwork/internal/nftables/incremental_update.nft.gotmpl +++ b/daemon/libnetwork/internal/nftables/incremental_update.nft.gotmpl @@ -34,7 +34,7 @@ table {{$family}} {{$tableName}} { } {{end}} {{range .Chains}}{{if .MustFlush}}chain {{.Name}} { - {{if .ChainType}}type {{.ChainType}} hook {{.Hook}}{{if .Device}} device "{{.Device}}"{{end}} priority {{.Priority}}; policy {{.Policy}}{{end}} + {{if .ChainType}}type {{.ChainType}} hook {{.Hook}}{{if .Device}} device "{{.Device}}"{{end}} priority {{.Priority}}; policy {{.Policy}};{{end}} } ; {{end}}{{end}} } {{if .MustFlush}}flush table {{$family}} {{$tableName}}{{end}} @@ -52,7 +52,7 @@ table {{$family}} {{$tableName}} { {{end}} table {{$family}} {{$tableName}} { {{range .Chains}}{{if .MustFlush}}chain {{.Name}} { - {{if .ChainType}}type {{.ChainType}} hook {{.Hook}}{{if .Device}} device "{{.Device}}"{{end}} priority {{.Priority}}; policy {{.Policy}}{{end}} + {{if .ChainType}}type {{.ChainType}} hook {{.Hook}}{{if .Device}} device "{{.Device}}"{{end}} priority {{.Priority}}; policy {{.Policy}};{{end}} {{range .Rules}}{{.}} {{end}} } diff --git a/daemon/libnetwork/internal/nftables/reload.nft.gotmpl b/daemon/libnetwork/internal/nftables/reload.nft.gotmpl index c48b067060..0f820b4b9a 100644 --- a/daemon/libnetwork/internal/nftables/reload.nft.gotmpl +++ b/daemon/libnetwork/internal/nftables/reload.nft.gotmpl @@ -33,7 +33,7 @@ table {{$family}} {{$tableName}} { } {{end}} {{range .Chains}}chain {{.Name}} { - {{if .ChainType}}type {{.ChainType}} hook {{.Hook}}{{if .Device}} device "{{.Device}}"{{end}} priority {{.Priority}}; policy {{.Policy}}{{end}} + {{if .ChainType}}type {{.ChainType}} hook {{.Hook}}{{if .Device}} device "{{.Device}}"{{end}} priority {{.Priority}}; policy {{.Policy}};{{end}} {{range .Rules}}{{.}} {{end}} }