Re: [nf-next PATCH] netfilter: nfnetlink_hook: Dump nat type chains

[Florian Westphal <fw@strlen.de>]

Phil Sutter <phil@nwl.cc> wrote:
> These chains are indirectly attached to the hook since they are
> not called for packets belonging to an established connection.
> 
> Introduce NF_HOOK_OP_NAT to identify the container and dump attached
> entries instead of the container itself.

Please lets not do this.

Before:

        hook postrouting {
                +0000000100 nf_nat_ipv6_out [nf_nat]
                +2147483647 nf_confirm [nf_conntrack]
        }

After:
        hook postrouting {
                +0000200000 chain inet nat postrouting [nft_chain_nat]
                +2147483647 nf_confirm [nf_conntrack]
        }

... and thats not true.  The nat chain isn't hooked at 200000.

It hooks at +100, this is a dispatcher.
Concealing the actual hook location and then unrolling the embedded
nat hooks gives a wrong impression and will mislead users wrt. the
actual ordering.

If we really want the ability to list the nat hooks, I think this
needs a new command to dump them.