|
 |
9ff721 |
From 8d5b7e557b65cd547b55567ac3dfbb2ea3f65418 Mon Sep 17 00:00:00 2001
|
|
|
9ff721 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
9ff721 |
Date: Mon, 12 Nov 2018 15:02:52 +0100
|
|
|
9ff721 |
Subject: [PATCH] nft.8: Clarify 'index' option of add rule command
|
|
|
9ff721 |
|
|
|
9ff721 |
Documentation for add rule command might trick readers into believing
|
|
|
9ff721 |
the optional 'index' argument does not need to be that of an existing
|
|
|
9ff721 |
rule. This false assumption is fueled by the fact that iptables allows
|
|
|
9ff721 |
to insert with last rule number + 1 to actually append to a chain.
|
|
|
9ff721 |
Change the relevant sentence to clarify that.
|
|
|
9ff721 |
|
|
|
9ff721 |
While being at it, drop the deprecated 'position' option from
|
|
|
9ff721 |
documentation - since this will likely go away at some point, don't
|
|
|
9ff721 |
encourage users to use it although they should notice that they
|
|
|
9ff721 |
shoudn't.
|
|
|
9ff721 |
|
|
|
9ff721 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
9ff721 |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
9ff721 |
(cherry picked from commit f4e40e395af2b73cd72c5454e41fb879da8c5f61)
|
|
|
9ff721 |
|
|
|
9ff721 |
Conflicts:
|
|
|
9ff721 |
doc/nft.txt
|
|
|
9ff721 |
-> Patch applied manually to doc/nft.xml from asciidoc source.
|
|
|
9ff721 |
|
|
|
9ff721 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
9ff721 |
---
|
|
|
9ff721 |
doc/nft.xml | 11 +++--------
|
|
|
9ff721 |
1 file changed, 3 insertions(+), 8 deletions(-)
|
|
|
9ff721 |
|
|
|
9ff721 |
diff --git a/doc/nft.xml b/doc/nft.xml
|
|
|
9ff721 |
index 22d57ac630037..512724ed8f9a7 100644
|
|
|
9ff721 |
--- a/doc/nft.xml
|
|
|
9ff721 |
+++ b/doc/nft.xml
|
|
|
9ff721 |
@@ -877,10 +877,7 @@ add table inet mytable
|
|
|
9ff721 |
<replaceable>chain</replaceable>
|
|
|
9ff721 |
<group choice="opt">
|
|
|
9ff721 |
<arg>
|
|
|
9ff721 |
- <group choice="req">
|
|
|
9ff721 |
- <arg>handle</arg>
|
|
|
9ff721 |
- <arg>position</arg>
|
|
|
9ff721 |
- </group>
|
|
|
9ff721 |
+ <literal>handle</literal>
|
|
|
9ff721 |
<replaceable>handle</replaceable>
|
|
|
9ff721 |
</arg>
|
|
|
9ff721 |
<arg>
|
|
|
9ff721 |
@@ -917,8 +914,8 @@ add table inet mytable
|
|
|
9ff721 |
</para>
|
|
|
9ff721 |
<para>
|
|
|
9ff721 |
The <literal>add</literal> and <literal>insert</literal> commands support an optional
|
|
|
9ff721 |
- location specifier, which is either a <replaceable>handle</replaceable> of an existing
|
|
|
9ff721 |
- rule or an <replaceable>index</replaceable> (starting at zero). Internally,
|
|
|
9ff721 |
+ location specifier, which is either a <replaceable>handle</replaceable> or the
|
|
|
9ff721 |
+ <replaceable>index</replaceable> (starting at zero) of an existing rule. Internally,
|
|
|
9ff721 |
rule locations are always identified by <replaceable>handle</replaceable> and the
|
|
|
9ff721 |
translation from <replaceable>index</replaceable> happens in userspace. This has two
|
|
|
9ff721 |
potential implications in case a concurrent ruleset change happens after the translation
|
|
|
9ff721 |
@@ -935,8 +932,6 @@ add table inet mytable
|
|
|
9ff721 |
Add a new rule described by the list of statements. The rule is appended to the
|
|
|
9ff721 |
given chain unless a <literal>handle</literal> is specified, in which case the
|
|
|
9ff721 |
rule is appended to the rule given by the <replaceable>handle</replaceable>.
|
|
|
9ff721 |
- The alternative name <literal>position</literal> is deprecated and should not be
|
|
|
9ff721 |
- used anymore.
|
|
|
9ff721 |
</para>
|
|
|
9ff721 |
</listitem>
|
|
|
9ff721 |
</varlistentry>
|
|
|
9ff721 |
--
|
|
|
bacbc8 |
2.21.0
|
|
|
9ff721 |
|