[nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Phil Sutter]

Commit 13535a3b40b62 ("files: restore base table skeletons") moved
config skeletons back from examples/ to /etc/nftables/ directory, but
ignored the fact that commit 6c9230e79339c ("nftables: rearrange files
and examples") added a new file 'netdev-ingress.nft' which is referenced
from 'all-in-one.nft' as well.

Fixes: 13535a3b40b62 ("files: restore base table skeletons")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---
 files/nftables/Makefile.am                      | 3 ++-
 files/{examples => nftables}/netdev-ingress.nft | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)
 rename files/{examples => nftables}/netdev-ingress.nft (87%)

diff --git a/files/nftables/Makefile.am b/files/nftables/Makefile.am
index f18156d844e5c..a93b7978f62d4 100644
--- a/files/nftables/Makefile.am
+++ b/files/nftables/Makefile.am
@@ -10,7 +10,8 @@ dist_pkgsysconf_DATA =	all-in-one.nft		\
 			ipv6-filter.nft		\
 			ipv6-mangle.nft		\
 			ipv6-nat.nft		\
-			ipv6-raw.nft
+			ipv6-raw.nft		\
+			netdev-ingress.nft
 
 install-data-hook:
 	${SED} -i 's|@sbindir[@]|${sbindir}/|g' ${DESTDIR}${pkgsysconfdir}/*.nft
diff --git a/files/examples/netdev-ingress.nft b/files/nftables/netdev-ingress.nft
similarity index 87%
rename from files/examples/netdev-ingress.nft
rename to files/nftables/netdev-ingress.nft
index 2585d15493885..9e46b15a7e596 100755
--- a/files/examples/netdev-ingress.nft
+++ b/files/nftables/netdev-ingress.nft
@@ -1,4 +1,4 @@
-#!/usr/sbin/nft -f
+#!@sbindir@nft -f
 
 # mind the NIC, it must exists
 table netdev filter {
-- 
2.21.0

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> Commit 13535a3b40b62 ("files: restore base table skeletons") moved
> config skeletons back from examples/ to /etc/nftables/ directory, but
> ignored the fact that commit 6c9230e79339c ("nftables: rearrange files
> and examples") added a new file 'netdev-ingress.nft' which is referenced
> from 'all-in-one.nft' as well.

Right.  Do you think we should also add in inet-nat.nft example,
or even replace the ipvX- ones?

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Phil Sutter]

Hi Florian,

On Mon, Jun 24, 2019 at 05:14:46PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > Commit 13535a3b40b62 ("files: restore base table skeletons") moved
> > config skeletons back from examples/ to /etc/nftables/ directory, but
> > ignored the fact that commit 6c9230e79339c ("nftables: rearrange files
> > and examples") added a new file 'netdev-ingress.nft' which is referenced
> > from 'all-in-one.nft' as well.
> 
> Right.  Do you think we should also add in inet-nat.nft example,
> or even replace the ipvX- ones?

Having an inet family nat example would be wonderful! Can inet NAT
replace IPvX-ones completely or are there any limitations as to what is
possible in rules?

Cheers, Phil

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Florian Westphal]

Phil Sutter <phil@nwl.cc> wrote:
> > Right.  Do you think we should also add in inet-nat.nft example,
> > or even replace the ipvX- ones?
> 
> Having an inet family nat example would be wonderful! Can inet NAT
> replace IPvX-ones completely or are there any limitations as to what is
> possible in rules?

I'm not aware of any limitations.

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Pablo Neira Ayuso]

On Mon, Jun 24, 2019 at 06:49:41PM +0200, Florian Westphal wrote:
> Phil Sutter <phil@nwl.cc> wrote:
> > > Right.  Do you think we should also add in inet-nat.nft example,
> > > or even replace the ipvX- ones?
> > 
> > Having an inet family nat example would be wonderful! Can inet NAT
> > replace IPvX-ones completely or are there any limitations as to what is
> > possible in rules?
> 
> I'm not aware of any limitations.

Only limitation is that older kernels do not support NAT for the inet
family.

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Phil Sutter]

On Tue, Jun 25, 2019 at 02:24:04AM +0200, Pablo Neira Ayuso wrote:
> On Mon, Jun 24, 2019 at 06:49:41PM +0200, Florian Westphal wrote:
> > Phil Sutter <phil@nwl.cc> wrote:
> > > > Right.  Do you think we should also add in inet-nat.nft example,
> > > > or even replace the ipvX- ones?
> > > 
> > > Having an inet family nat example would be wonderful! Can inet NAT
> > > replace IPvX-ones completely or are there any limitations as to what is
> > > possible in rules?
> > 
> > I'm not aware of any limitations.
> 
> Only limitation is that older kernels do not support NAT for the inet
> family.

OK, so maybe add inet NAT example but not delete ip/ip6 ones?

What is the status regarding my patch, please? I think fixing
netdev-ingress.nft location is unrelated to this discussion, right?

Cheers, Phil

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Pablo Neira Ayuso]

On Wed, Jul 03, 2019 at 12:56:00PM +0200, Phil Sutter wrote:
> On Tue, Jun 25, 2019 at 02:24:04AM +0200, Pablo Neira Ayuso wrote:
> > On Mon, Jun 24, 2019 at 06:49:41PM +0200, Florian Westphal wrote:
> > > Phil Sutter <phil@nwl.cc> wrote:
> > > > > Right.  Do you think we should also add in inet-nat.nft example,
> > > > > or even replace the ipvX- ones?
> > > > 
> > > > Having an inet family nat example would be wonderful! Can inet NAT
> > > > replace IPvX-ones completely or are there any limitations as to what is
> > > > possible in rules?
> > > 
> > > I'm not aware of any limitations.
> > 
> > Only limitation is that older kernels do not support NAT for the inet
> > family.
> 
> OK, so maybe add inet NAT example but not delete ip/ip6 ones?

Agreed.

> What is the status regarding my patch, please? I think fixing
> netdev-ingress.nft location is unrelated to this discussion, right?

Oh right, I got confused by the discussion.

Re: [nft PATCH] files: Move netdev-ingress.nft to /etc/nftables as well

[Pablo Neira Ayuso]

On Mon, Jun 24, 2019 at 05:12:38PM +0200, Phil Sutter wrote:
> Commit 13535a3b40b62 ("files: restore base table skeletons") moved
> config skeletons back from examples/ to /etc/nftables/ directory, but
> ignored the fact that commit 6c9230e79339c ("nftables: rearrange files
> and examples") added a new file 'netdev-ingress.nft' which is referenced
> from 'all-in-one.nft' as well.

Applied, thanks.