Re: [PATCH nft] src: ingress inet support

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Arturo,

On Wed, Oct 14, 2020 at 05:54:13PM +0200, Arturo Borrero Gonzalez wrote:
> On 2020-10-13 13:38, Pablo Neira Ayuso wrote:
> > Add support for inet ingress chains.
> > 
> >  table inet filter {
> >         chain ingress {
> >                 type filter hook ingress device "veth0" priority filter; policy accept;
> >         }
> > 	chain input {
> > 		type filter hook input priority filter; policy accept;
> > 	}
> > 	chain forward {
> > 		type filter hook forward priority filter; policy accept;
> > 	}
> >  }
> 
> This sound interesting, thanks.
> 
> I could see some questions coming from users:
> 
> * where are the docs on which packet/traffic sees this nft family vs netdev?
> * what are the added benefit of this nft family vs netdev?

See patch update for documentation, let me know if this addresses
these two questions. I can extend it further, let me know.

> * is the netdev family somehow deprecated?

I don't think so. The netdev family is still useful for filter packet
of any possible ethertype that are entering through a given device
(for instance ARP, 802.1q, 802.1ad among others). The only difference
between inet ingress and netdev ingress is that the sets and maps that
are defined in a given inet table can be accessed from the ingress
chain, note that it is not possible to access inet sets and maps from
the netdev ingress chain.

If your ruleset if focused on traffic filtering for IPv4 and IPv6,
then inet ingress should be enough.

The ingress netdev chain also comes with hardware offload support,
which allows you to drop packets from the NIC, which might be useful
in DoS scenarios to save CPU cycles. You only have to check if your
NIC is supported.