Re: Dangerous examples in nftables documentation

Dňa 6. januára 2026 14:47:01 UTC používateľ Dmitry Konishchev <[email protected]> napísal:

>Hi! Recently I've faced a problem: I have a rule that drops all new
>TCP connections which start not with SYN packets:
>ct state new tcp flags != syn counter goto bad_tcp_new_packet

You are right, the SYN packets are commonly used with some
other TCP flags, but did you realized that examples are just, ehm,
examples?

>So `tcp flags & (syn|ack|rst|fin) != syn` should be used instead of
>`tcp flags != syn`.

You are right, the `tcp flags != syn` is harmful in most cases, but it is
not as simple, as one can think, it can depend on what rules are
applied before. In my case i do early drop of packets in invalid
state, thus SYN+FIN nor SYN+RST will not appear latter. How useful
is then to check these combinations? (more typing == more typos).

Note that match:

    tcp flags syn

Is the same as:

    tcp flags & syn == syn

Thus it doesn't takes other flags into account and matches (or not) just
on existence of SYN flag, which can be what one want, but not in all
cases.

>The problem I see is that the official documentation suggest unsafe
>matching in its examples without any warning:

The official documentation is as it is, but it is not TCP tutorial nor
firewall building tutorial. In most cases it is just demonstration
of nftables syntax. The valid TCP flags combinations are docemented
in kernel sources, it will be redundant to repeat it in nftables (except
point to right source file, as it is hard to find).

When one goes into more depth (than filter on src/dst address/port),
then must understand how it works, what is in RFCs, how real SW
implements it (often two different things) and what is wanted. And
when one will understand what he/she want to do, and how to do that,
then he/she will not trap itself in Ctrl+C/Ctrl+V problem ;-)

BTW i have own notes about TCP flags syntax in both, the iptables
and nftables. I rewrote these nftables notes multiple times, in hope
that it can be both, complete and not overcomplicated -- without
success :-D

regards


-- 
Slavko
https://www.slavino.sk/