Merge upstream

.github/workflows/build-and-test.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       matrix:
         # Keep MSRV in sync with rust-version in Cargo.toml
-        rust: [stable, beta, nightly, 1.63.0]
+        rust: [stable, beta, nightly, 1.85.0]
     runs-on: ubuntu-latest
     steps:
       - name: Install build dependencies

.github/workflows/git-commit-message-style.yml

@@ -30,3 +30,6 @@ jobs:
           allow-one-liners: 'true'
           # This action defaults to 50 char subjects, but 72 is fine.
           max-subject-line-length: '72'
+          # The action's wordlist is a bit short. Add more accepted verbs.
+          additional-verbs: 'tidy, wrap, obfuscate, bias, prohibit, forbid, revert, slim, impl, disregard, reproduce,
+            signal, guarantee, cap, parallelize'

CHANGELOG.md

@@ -17,6 +17,41 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ## [Unreleased]
 
 
+## [0.9.1] - 2025-12-08
+### Fixed
+- Avoid raising `NLM_F_ACK` for batch start/end messages on kernel version prior to 6.10.
+
+
+## [0.9.0] - 2025-11-26
+### Added
+- Generate bindings for libnftnl 1.0.3 through 1.3.0.
+- Add support for Socket expressions.
+- Implement `ToSlice` for `u64`.
+- Implement `ToSlice` for `&CStr`.
+
+### Changed
+- Upgrade to rust edition 2024.
+- Expose message sequence numbers from batch.
+
+### Fixed
+- Fix buffer-overflow in `Batch::with_page_size` due to insufficient allocation for malformed
+  page sizes. Panic in these cases instead.
+- Fix endianess in `ToSlice` implementations for integer types by using native endianess instead
+  of assuming little endian.
+
+### Removed
+- Remove `ToSlice` implementation for `&str` in favor of `&CStr`.
+
+
+## [0.8.0] - 2025-10-30
+### Added
+- Add support for ingress hooks. Corresponds to `NF_INET_INGRESS`.
+- Specify `links` manifest key `nftnl-sys`. This allows dependants to pass custom build flags.
+
+### Changed
+- Bump MSRV to 1.85.0 for `nftnl` and `nftnl-sys`.
+
+
 ## [0.7.0] - 2024-09-19
 ### Added
 - Implement `Default` for `nftnl::batch::Batch`.

LICENSE-MIT

@@ -1,4 +1,4 @@
-Copyright (c) 2017 Amagicom AB
+Copyright (c) 2025 Mullvad VPN AB
 
 Permission is hereby granted, free of charge, to any
 person obtaining a copy of this software and associated

nftnl-sys/Cargo.toml

@@ -1,28 +1,48 @@
 [package]
 name = "nftnl-sys"
-version = "0.6.2"
+version = "0.6.4"
 authors = ["Mullvad VPN"]
 license = "MIT OR Apache-2.0"
 description = "Low level FFI bindings to libnftnl. Provides low-level userspace access to the in-kernel nf_tables subsystem"
 repository = "https://github.com/mullvad/nftnl-rs"
 readme = "README.md"
 keywords = ["nftables", "nft", "firewall", "iptables", "netfilter"]
 categories = ["network-programming", "os::unix-apis", "external-ffi-bindings", "no-std"]
-edition = "2021"
-rust-version = "1.63.0"
+edition = "2024"
+rust-version = "1.85.0"
+links = "nftnl"
 
 
 [features]
-nftnl-1-0-7 = []
-nftnl-1-0-8 = ["nftnl-1-0-7"]
-nftnl-1-0-9 = ["nftnl-1-0-8"]
-nftnl-1-1-0 = ["nftnl-1-0-9"]
-nftnl-1-1-1 = ["nftnl-1-1-0"]
+nftnl-1-3-0 = ["nftnl-1-2-9"]
+nftnl-1-2-9 = ["nftnl-1-2-8"]
+nftnl-1-2-8 = ["nftnl-1-2-7"]
+nftnl-1-2-7 = ["nftnl-1-2-6"]
+nftnl-1-2-6 = ["nftnl-1-2-5"]
+nftnl-1-2-5 = ["nftnl-1-2-4"]
+nftnl-1-2-4 = ["nftnl-1-2-3"]
+nftnl-1-2-3 = ["nftnl-1-2-2"]
+nftnl-1-2-2 = ["nftnl-1-2-1"]
+nftnl-1-2-1 = ["nftnl-1-2-0"]
+nftnl-1-2-0 = ["nftnl-1-1-9"]
+nftnl-1-1-9 = ["nftnl-1-1-8"]
+nftnl-1-1-8 = ["nftnl-1-1-7"]
+nftnl-1-1-7 = ["nftnl-1-1-6"]
+nftnl-1-1-6 = ["nftnl-1-1-5"]
+nftnl-1-1-5 = ["nftnl-1-1-4"]
+nftnl-1-1-4 = ["nftnl-1-1-3"]
+nftnl-1-1-3 = ["nftnl-1-1-2"]
 nftnl-1-1-2 = ["nftnl-1-1-1"]
+nftnl-1-1-1 = ["nftnl-1-1-0"]
+nftnl-1-1-0 = ["nftnl-1-0-9"]
+nftnl-1-0-9 = ["nftnl-1-0-8"]
+nftnl-1-0-8 = ["nftnl-1-0-7"]
+nftnl-1-0-7 = []
 
 [dependencies]
 cfg-if = "1.0"
 libc = "0.2.166"
+mnl-sys = "0.2.2" # Find and link `libmnl`
 
 [build-dependencies]
 cfg-if = "1.0"

nftnl-sys/README.md

@@ -7,10 +7,22 @@ See [`nftnl`] for a higher level safe abstraction.
 
 ## Linking to libmnl and libnftnl
 
+### `pkg-config`
 By default this crate uses pkg-config to find and link to its C dependencies, [`libmnl`] and
-[`libnftnl`]. To manually configure where to look for these libraries, set the environment
+[`libnftnl`].
+
+### Manually
+To manually configure where to look for these libraries, either set the environment
 variables `LIBMNL_LIB_DIR` and `LIBNFTNL_LIB_DIR` to point to the directories where `libmnl.so`
-(or `libmnl.a`) and `libnftnl.so` (or `libnftnl.a`) reside.
+(or `libmnl.a`) and `libnftnl.so` (or `libnftnl.a`) reside, or [`override the build script`] to
+manually set the linker directives for both `nftnl` and `mnl`:
+
+```toml
+# .cargo/config.toml
+[target.x86_64-unknown-linux-gnu.nftnl]
+rustc-link-lib = ["nftnl", "mnl"]
+rustc-link-search = ["<type>=<path-to-libnftnl>", "<type>=<path-to-libmnl>"]
+```
 
 ## Selecting version of `libnftnl`
 
@@ -31,5 +43,6 @@ nftnl-sys = { version = "0.1", features = ["nftnl-1-0-9"] }
 [`libmnl`]: https://netfilter.org/projects/libmnl/
 [`nftnl`]: https://crates.io/crates/nftnl
 [`bindgen`]: https://crates.io/crates/bindgen
+[`override the build script`]: https://doc.rust-lang.org/cargo/reference/build-scripts.html#overriding-build-scripts
 
 License: MIT/Apache-2.0