This excerpt from the nft man page:
[add | insert] rule [family] table chain [position position] statement...
replace rule [family] table chain handle handle statement...
delete rule [family] table chain handle handle
seems to imply that "insert ... position .." should use an offset into the ruleset, but it actually takes a handle just like delete/replace verbs.
At minimum the man page should be fixed to read something like
[add | insert] rule [family] table chain [position handle] statement...
to make it clear this is handle, not an index (like iptables).
Upstream commit to backport:
Author: Phil Sutter <email@example.com>
Date: Wed May 9 16:03:40 2018 +0200
Deprecate add/insert rule 'position' argument
Instead, use 'handle' keyword for the same effect since that is more
consistent with respect to replace/delete commands. The old keyword is
still supported for backwards compatibility and also listed in man page
along with a hint that it shouldn't be used anymore.
Signed-off-by: Phil Sutter <firstname.lastname@example.org>
Signed-off-by: Pablo Neira Ayuso <email@example.com>
Based on our e-mail communication, I've just written a draft of a RN description in the Doc Text field. Could you please check it?
(In reply to Mirek Jahoda from comment #7)
> Based on our e-mail communication, I've just written a draft of a RN
> description in the Doc Text field. Could you please check it?
Looks good to me, thanks!
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.