Bug 1571968

Summary: nftables: man page implies "insert ... position ..." uses a rule offset
Product: Red Hat Enterprise Linux 7 Reporter: Eric Garver <egarver>
Component: nftablesAssignee: Phil Sutter <psutter>
Status: CLOSED ERRATA QA Contact: Jiri Peska <jpeska>
Severity: medium Docs Contact: Mirek Jahoda <mjahoda>
Priority: medium    
Version: 7.6CC: jpeska, mjahoda, psutter, todoleza
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: nftables-0.8-9.el7 Doc Type: Enhancement
Doc Text:
`position` in an *nftables* add or insert rule is replaced by `handle` and `index` With this update of the _nftables_ packages, the `position` parameter in an add or insert rule has been deprecated and replaced by the `handle` and `index` arguments. This syntax is more consistent with the replace and delete commands.
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-30 10:38:13 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Eric Garver 2018-04-25 20:07:36 UTC
This excerpt from the nft man page:

       [add | insert] rule [family] table chain [position position] statement...
       replace rule [family] table chain handle handle statement...
       delete rule [family] table chain handle handle

seems to imply that "insert ... position .." should use an offset into the ruleset, but it actually takes a handle just like delete/replace verbs.

At minimum the man page should be fixed to read something like

       [add | insert] rule [family] table chain [position handle] statement...
to make it clear this is handle, not an index (like iptables).

Comment 2 Phil Sutter 2018-06-06 08:59:54 UTC
Upstream commit to backport:

commit effb881c9cef28aca47adeec5014e0457507539e
Author: Phil Sutter <phil>
Date:   Wed May 9 16:03:40 2018 +0200

    Deprecate add/insert rule 'position' argument
    Instead, use 'handle' keyword for the same effect since that is more
    consistent with respect to replace/delete commands. The old keyword is
    still supported for backwards compatibility and also listed in man page
    along with a hint that it shouldn't be used anymore.
    Signed-off-by: Phil Sutter <phil>
    Signed-off-by: Pablo Neira Ayuso <pablo>

Comment 7 Mirek Jahoda 2018-08-17 15:08:33 UTC
Based on our e-mail communication, I've just written a draft of a RN description in the Doc Text field. Could you please check it?

Comment 8 Phil Sutter 2018-08-17 16:43:38 UTC
Hi Mirek,

(In reply to Mirek Jahoda from comment #7)
> Based on our e-mail communication, I've just written a draft of a RN
> description in the Doc Text field. Could you please check it?

Looks good to me, thanks!

Comment 13 errata-xmlrpc 2018-10-30 10:38:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.