Nftables HOWTO documentation updates

Hi,

I have registered a subdomain for nftables that hosts the nftables user HOWTO, you can reach it via:

http://wiki.nftables.org

This documentation is based on the original work from Eric Leblond's nftables quick HOWTO [1], so you may find that I have reused some examples and comments from that document in this new place.

The aim of this documentation is to provide a user-oriented introduction to the new concepts by examples. The website doesn't look fancy and you probably will find typos or things that need to be improved and expanded, but with some extra work and time it will progressively get improved.

The website is using a wiki, however, public edition has been disabled to avoid the overhead that resulting from typical wiki vandalism. So the plan is to provide edit access by invitation to a group of selected people.

If you have comments, requests and suggestions to improve it, please, let us know. Thanks!

[1] https://home.regit.org/netfilter-en/nftables-quick-howto/

P.S: I would like to thank the NLNet foundation for sponsoring this initial HOWTO documentation (http://www.nlnet.nl).

I checked out the HOWTO and it gives a really nice concise introduction to how nftables work. Good work!

After browsing through the pages I have two questions:

Is it possible to comment rules like in iptables? Comments in iptables made it really easy to manage rules on a logical level i.e. I could define rule "types" by adding a special comment like "TYPE:X" and then use that to grep for these rules to batch-remove them or retrieve the counter values. It would be nice to be able to tag rules like this.

How do I insert multiple rules? The insertion example show the addition of a single rule after a known handle but what if I want to add a second rule after that? As far as I can tell from the example the add rule command does not return the handle of the inserted rule so I have no idea where to insert the second rule. Even if the command returned the handle it would still require scripting to add multiple consecutive rules so there should be a way to specify to add a list of rules (atomically?) after a given handle.

Not sure if these features are not available or just not documented yet but I'm approaching this by thinking about the use-cases I encounter and looking at how I would implement these using nftables instead of iptables.

Regards,
Dennis

Not possible yet.
There are some details about the implementation that have to be discussed. For example: how/where to store the comment.

As user, I'm also interested in this feature. Maybe we can add to the TODO list.

regards

Arturo Borrero González

Hi,

As Arturo said, that's not yet implemented. I've been trying to find a way which doesn't involve to store that comment string in the kernel, given that this information is not used by the kernel in any way, but all what I come out with was overly complicated and not nice.

So, assuming we store this comment string in kernel-space, I see several possibilities at this moment:

* Add an expression for comments, which is sort of abuse since we'll iterate in nft_do_chain() over one expression which does nothing, so it adds some runtime overhead to the packet handling. This is what the iptables comment match current does, btw.

* Adding a comment field to nft_rule structure, which means that we have to consume a 4/8 extra bytes in the nft_rule structure for a feature that may not be used by everyone.

* Attach this this at the end of the expression data area (but *not* abusing the expression infrastructure). I think this has no runtime overhead and no extra memory consumption for those that don't need this comment feature, so it's the way to go IMO.

That's not yet support either. I think we'll need to keep some context information in the batch handling so you can add several list after a given handle.

Sounds very reasonable. I'd suggest to not make this specific to comments, but simply call it "userdata" or something so we we can put whatever we like in there. Interpretation would be up to userspace.