Bug 1571968 - nftables: man page implies "insert ... position ..." uses a rule offset
Summary: nftables: man page implies "insert ... position ..." uses a rule offset
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: nftables   
(Show other bugs)
Version: 7.6
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Phil Sutter
QA Contact: Jiri Peska
Mirek Jahoda
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-25 20:07 UTC by Eric Garver
Modified: 2018-10-30 10:38 UTC (History)
4 users (show)

Fixed In Version: nftables-0.8-9.el7
Doc Type: Enhancement
Doc Text:
`position` in an *nftables* add or insert rule is replaced by `handle` and `index` With this update of the _nftables_ packages, the `position` parameter in an add or insert rule has been deprecated and replaced by the `handle` and `index` arguments. This syntax is more consistent with the replace and delete commands.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-10-30 10:38:13 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3154 None None None 2018-10-30 10:38 UTC

Description Eric Garver 2018-04-25 20:07:36 UTC
This excerpt from the nft man page:

RULES
       [add | insert] rule [family] table chain [position position] statement...
       replace rule [family] table chain handle handle statement...
       delete rule [family] table chain handle handle

seems to imply that "insert ... position .." should use an offset into the ruleset, but it actually takes a handle just like delete/replace verbs.

At minimum the man page should be fixed to read something like

       [add | insert] rule [family] table chain [position handle] statement...
                                                          ^^^^^^
to make it clear this is handle, not an index (like iptables).

Comment 2 Phil Sutter 2018-06-06 08:59:54 UTC
Upstream commit to backport:

commit effb881c9cef28aca47adeec5014e0457507539e
Author: Phil Sutter <phil@nwl.cc>
Date:   Wed May 9 16:03:40 2018 +0200

    Deprecate add/insert rule 'position' argument
    
    Instead, use 'handle' keyword for the same effect since that is more
    consistent with respect to replace/delete commands. The old keyword is
    still supported for backwards compatibility and also listed in man page
    along with a hint that it shouldn't be used anymore.
    
    Signed-off-by: Phil Sutter <phil@nwl.cc>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Comment 7 Mirek Jahoda 2018-08-17 15:08:33 UTC
Based on our e-mail communication, I've just written a draft of a RN description in the Doc Text field. Could you please check it?

Comment 8 Phil Sutter 2018-08-17 16:43:38 UTC
Hi Mirek,

(In reply to Mirek Jahoda from comment #7)
> Based on our e-mail communication, I've just written a draft of a RN
> description in the Doc Text field. Could you please check it?

Looks good to me, thanks!

Comment 13 errata-xmlrpc 2018-10-30 10:38:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3154


Note You need to log in before you can comment on or make changes to this bug.