Re: Dropping of the end of a chain

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Nov 14, 2024 at 04:26:42PM +0000, Kerin Millar wrote:
> On Thu, 14 Nov 2024, at 3:51 PM, Kerin Millar wrote:
> > On Thu, 14 Nov 2024, at 2:01 PM, Thomas Köller wrote:
> >> The nft manpage states that if the end of a chain invoked via 'goto' is 
> >> reached without a verdict, 'evaluation will continue at the last chain 
> >> instead of the one containing the goto statement'. I cannot make sense 
> >> of this; what is the 'last chain'?
> >
> > To say "last chain" is highly ambiguous. I suggest that it be rewritten 
> > as "evaluation will continue as if the invoking rule had instead 
> > specified 'return' as its verdict." Such would be simple, coherent and 
> > correct.
> 
> I just re-read the relevant section of the manual, which is as follows.
> 
>        goto chain   Similar to jump, but the current position is not pushed to
>                     the call stack, meaning that after the new chain evaluation
>                     will continue at the last chain instead of the one
>                     containing the goto statement.
> 
> I think that the language is reasonably clear as it stands, though it is lacking in punctuation. However, I can see how some readers would be thrown by the use of the world "last", particularly those that do not understand the concept of a call stack.
> 
> Perhaps the following would be clearer, without unduly diminishing the technical nature of the language.
> 
>        goto chain   Similar to jump, only the current position is not pushed to
>                     the call stack. Consequently, once the evaluation of the new
>                     new chain has concluded, evaluation shall continue as if the
>                     the invoking rule had instead specified 'return' as its
>                     verdict.

This extract is very similar to what there is in the iptables manpage:

        goto chain   Similar to jump, only the current position is not pushed to
                     the call stack. This specifies that the evaluation should
                     continue in the specified chain. Unlike jump, return will
                     not continue evaluating in this chain but instead in the chain
                     that called us via jump.