nft -- documentation on fib_addrtype missing, more data

nft -- documentation on fib_addrtype missing, more data

[Stephen Satchell]

Poking around looking for more information, I ran across this little tidbit:

From man 7 rtnetlink:
      rtm_type          Route type
      -----------------------------------------------------------------
      RTN_UNSPEC        unknown route
      RTN_UNICAST       a gateway or direct route
      RTN_LOCAL         a local interface route
      RTN_BROADCAST     a local broadcast route (sent as a broadcast)
      RTN_ANYCAST       a local broadcast route (sent as a unicast)
      RTN_MULTICAST     a multicast route
      RTN_BLACKHOLE     a packet dropping route
      RTN_UNREACHABLE   an unreachable destination
      RTN_PROHIBIT      a packet rejection route
      RTN_THROW         continue routing lookup in another table

This clears up the confusion I had about "anycast" versus "broadcast".

Is there a shell tool that will show the route type(s) for a
specified address?

Re: nft -- documentation on fib_addrtype missing, more data

[Pablo Neira Ayuso]

On Thu, Oct 10, 2019 at 02:45:59PM -0700, Stephen Satchell wrote:
> Poking around looking for more information, I ran across this little tidbit:
> 
> From man 7 rtnetlink:
>       rtm_type          Route type
>       -----------------------------------------------------------------
>       RTN_UNSPEC        unknown route
>       RTN_UNICAST       a gateway or direct route
>       RTN_LOCAL         a local interface route
>       RTN_BROADCAST     a local broadcast route (sent as a broadcast)
>       RTN_ANYCAST       a local broadcast route (sent as a unicast)
>       RTN_MULTICAST     a multicast route
>       RTN_BLACKHOLE     a packet dropping route
>       RTN_UNREACHABLE   an unreachable destination
>       RTN_PROHIBIT      a packet rejection route
>       RTN_THROW         continue routing lookup in another table
> 
> This clears up the confusion I had about "anycast" versus "broadcast".
> 
> Is there a shell tool that will show the route type(s) for a
> specified address?

# nft describe fib saddr type
fib expression, datatype fib_addrtype (fib address type) (basetype integer), 32 bits

pre-defined symbolic constants (in decimal):
        unspec                                             0
        unicast                                            1
        local                                              2
        broadcast                                          3
        anycast                                            4
        multicast                                          5
        blackhole                                          6
        unreachable                                        7
        prohibit                                           8

Re: nft -- documentation on fib_addrtype missing, more data

[Florian Westphal]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> # nft describe fib saddr type
> fib expression, datatype fib_addrtype (fib address type) (basetype integer), 32 bits
> 
> pre-defined symbolic constants (in decimal):
[..]

It might make sense to teach nft describe to also work with the type,
so you could get the symbolic constants via

nft describe fib_addrtype

What do you think?

Re: nft -- documentation on fib_addrtype missing, more data

[Pablo Neira Ayuso]

On Fri, Oct 11, 2019 at 11:47:21AM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > # nft describe fib saddr type
> > fib expression, datatype fib_addrtype (fib address type) (basetype integer), 32 bits
> > 
> > pre-defined symbolic constants (in decimal):
> [..]
> 
> It might make sense to teach nft describe to also work with the type,
> so you could get the symbolic constants via
> 
> nft describe fib_addrtype
> 
> What do you think?

That's doable, yes.

Re: nft -- documentation on fib_addrtype missing, more data

[Stephen Satchell]

TL;DR:  The existing invocation "nft describe fib saddr type" (which I
didn't find documented) provides information describing fib_addrtype.
Consider adding these invocations, described below:

    nft describe fib_addrtype
    nft describe cmds
    nft show type <ip-address>          and/or
    nft show fib_addrtype <ip-address>  and/or
    nft show route <ip-address>

On 10/11/19 2:47 AM, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>> # nft describe fib saddr type
>> fib expression, datatype fib_addrtype (fib address type) (basetype integer), 32 bits
>>
>> pre-defined symbolic constants (in decimal):
> [..]
> 
> It might make sense to teach nft describe to also work with the type,
> so you could get the symbolic constants via
> 
> nft describe fib_addrtype
> 
> What do you think?

That's a good thing to do.  Instead of a verbose section, you can add to
"man 8 nft" before "Using fib expressions: this short paragraph:

> List valid fib_addrtype symbols using "nft describe fib_addrtype".
> Descriptions of their meaning can be found in the "RTM_NEWROUTE,
> RTM_DELROUTE, RTM_GETROUTE" section of man 7 rtnetlink
For the wiki, I suggest it would be better to pull the information
together.  Book and HOWTO authors can do the same thing, to minimize the
amount of cross-referencing.

What I would like to see in the wiki is an example routing table, with a
table of IP addresses and the value of fib_addrtype that would be
associated with it.

To assist the tech writer, add a new command:

    nft show type <ip-address>         and/or
    nft show fib_addrtype <ip-address> and/or
    nft show route <ip-address>

where "ip-address" is an IPv4 or IPv6 host address (not netblock).
Documentation for this would be added to the ADDITIONAL COMMANDS section
of the command page.  The command could show other information such as
the interface name and other routing information, that can be tested in
fib expressions, from the routing response.  I haven't found any tool to
provide this capability in the various network utilities.

While you are at it, consider adding "nft describe cmds" and adding a
line to the "nft --help" to tell the user to use this new facility.
Most Linux utilities would add this to the output of --help; I would
suggest keeping the list of command keywords separate.  (I thought about
"nft --help commands" as an alternative, but y'all might not like it.)

Isn't it great to have a complete noob like me coming on at this late date?