Re: [nf-next PATCH] netfilter: nfnetlink_hook: Dump nat type chains

[Florian Westphal <fw@strlen.de>]

Phil Sutter <phil@nwl.cc> wrote:
> Ah, so the nat-type chain's priority value orders it inside the
> dispatcher's list.

Yes.

> Maybe I should print them below the dispatcher hook with extra
> indentation? Maybe extra braces could further clarify, e.g.:
> 
> | hook postrouting {
> |         +0000000100 nf_nat_ipv6_out [nf_nat] {
> |                 +0000200000 chain inet nat postrouting [nft_chain_nat]
> |         }
> |         +2147483647 nf_confirm [nf_conntrack]
> | }

Actually  one could override the hook value with the one of the
nat base hook.  The ordering inside the dispatcher is whats important,
the exact numerical value isn't important.

> > If we really want the ability to list the nat hooks, I think this
> > needs a new command to dump them.
> 
> We may change 'nft list hooks' output arbitrarily, right? Or should we
> fear braking some third-party parsers when doing too fancy stuff?

Ugh. No mercy for screenscrapers.  But maybe my suggestion above is
enough.