Re: [PATCH nft 1/4] doc: add documentation about list hooks feature

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > +*list hooks* is enough to display everything that is active
> > +on the system, however, it does currently omit hooks that are
> > +tied to a specific network device (netdev family). To obtain
> > +those, the network device needs to be queried by name.
> 
> IIRC, the idea is to display the ingress path pipeline according to
> the device (if specified)
> 
>         list hooks netdev eth0
> 
> as for egress, as it is not possible to know where the packet is
> going, it is probably good to allow the user to specify the output
> device, so it gets the entire pipeline for ingress and egress
> paths, ie.
> 
> list hooks netdev eth0 eth1

Not really, why would eth0 and eth1 be related here?

What would make more sense to me is to allow

list hooks netdev

and then have nft fetch list of all network devices and then query them
all.

If a packet coming in on devX will be forwarded to devY depends on the
type of packet and the configuration, e.g. arp/ip vs. bridge/routing
or even encapsulation...

> Note that this is not implemented. This has limitations, discovering
> eth{0,1} belongs to bridge device would need more work (not asking to
> do this now, but it could be a nice usability feature to discover the
> pipeline?).

Bridge?  I don't think we have bridge family support for netdev hooks?
AFAIU its only netdev and inet.

This thing should only list the nf hooks registered for the device,
and not start to guess.  So for "list hooks br0", return ingress and
egress hooks for the virtual device, not the bridge ports.