From 3db0baf80ceaa09735873221a9acacc145673481 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 4 Jun 2025 19:53:47 +0200 Subject: [PATCH] doc: Basic documentation of anonymous chains Joint work with Folsk Pratima. Signed-off-by: Folsk Pratima Signed-off-by: Phil Sutter --- doc/nft.txt | 3 ++- doc/statements.txt | 19 ++++++++++++++++--- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/doc/nft.txt b/doc/nft.txt index c1bb4997..1be2fbac 100644 --- a/doc/nft.txt +++ b/doc/nft.txt @@ -397,7 +397,8 @@ CHAINS Chains are containers for rules. They exist in two kinds, base chains and regular chains. A base chain is an entry point for packets from the networking stack, a regular chain may be used as jump target and is used for better rule -organization. +organization. Regular chains can be anonymous, see *VERDICT STATEMENT* examples +for details. [horizontal] *add*:: Add a new chain in the specified table. When a hook and priority value diff --git a/doc/statements.txt b/doc/statements.txt index 79a01384..f9460dd7 100644 --- a/doc/statements.txt +++ b/doc/statements.txt @@ -3,8 +3,12 @@ VERDICT STATEMENT The verdict statement alters control flow in the ruleset and issues policy decisions for packets. [verse] +____ {*accept* | *drop* | *queue* | *continue* | *return*} -{*jump* | *goto*} 'chain' +{*jump* | *goto*} 'CHAIN' + +'CHAIN' := 'chain_name' | *{* 'statement' ... *}* +____ *accept* and *drop* are absolute verdicts -- they terminate ruleset evaluation immediately. @@ -26,15 +30,20 @@ resumes with the next base chain hook, not the rule following the queue verdict. *return*:: Return from the current chain and continue evaluation at the next rule in the last chain. If issued in a base chain, it is equivalent to the base chain policy. -*jump* 'chain':: Continue evaluation at the first rule in 'chain'. The current +*jump* 'CHAIN':: Continue evaluation at the first rule in 'CHAIN'. The current position in the ruleset is pushed to a call stack and evaluation will continue there when the new chain is entirely evaluated or a *return* verdict is issued. In case an absolute verdict is issued by a rule in the chain, ruleset evaluation terminates immediately and the specific action is taken. -*goto* 'chain':: Similar to *jump*, but the current position is not pushed to the +*goto* 'CHAIN':: Similar to *jump*, but the current position is not pushed to the call stack, meaning that after the new chain evaluation will continue at the last chain instead of the one containing the goto statement. +An alternative to specifying the name of an existing, regular chain in 'CHAIN' +is to specify an anonymous chain ad-hoc. Like with anonymous sets, it can't be +referenced from another rule and will be removed along with the rule containing +it. + .Using verdict statements ------------------- # process packets from eth0 and the internal network in from_lan @@ -42,6 +51,10 @@ resumes with the next base chain hook, not the rule following the queue verdict. filter input iif eth0 ip saddr 192.168.0.0/24 jump from_lan filter input iif eth0 drop + +# jump and goto statements support anonymous chain creation +filter input iif eth0 jump { ip saddr 192.168.0.0/24 drop ; udp dport domain drop; } + ------------------- PAYLOAD STATEMENT -- 2.47.2