Re: Dangerous examples in nftables documentation

Dňa 6. januára 2026 18:36:05 UTC používateľ Dmitry Konishchev <[email protected]> napísal:

>Oh... =) It's quite unexpected after `tcp flags != syn` which turns

There are multiple way to write the same thing, this is shortcut
(or how to name it in English):
 
    tcp flags FLAG 

(as i mentioned early, less typing == less typos, and one flag is
less to change than two flags, etc...) The full syntax is simple
bitwise operation & comparison:

    tcp flags & MASK == VALUE

The difference is, that shortcut has not equal/nonequal operator.
To be fuly confused, it is possible to use another form to get the
same (guess which syn is mask and which is value):

    tcp flags syn / syn

When you do just with equal/nonequal comparison, no mask is
applied, thus whole flags field value is compared::

    tcp flags == syn    # only SYN flag is set
    tcp flags != syn    # hard to describe for me in En :-P

Remember, that flags field is just 8-bit number, the "syn" itself
is number (named constant) too... Your friend is debug output:

    nft -c --debug=netlink add rule ...

The -c option is check (do not add rule at all), the output you will get
will ba something as this:

    [ payload load 1b @ transport header + 13 => reg 1 ]
    [ bitwise reg 1 = ( reg 1 & 0x00000002 ) ^ 0x00000000 ]
    [ cmp neq reg 1 0x00000000 ]

1, get value and store it in reg 1
2, do bitwise operation on reg 1 and store result in reg 1 (again)
3. compare that reg 1 is zero

For me the biggest problem is to understand bitwise operators,
as i usualy use named funczions (AND, XOR, NOT...), but with little
effort (and notes) it is understandable...

>out to be a simple comparison, as well as `ip daddr 1.2.3.4` is a
>simple comparison... Thanks! That's what I am talking about: the
>current documentation is so sparse, lacks details and having no

Did you read nft's manpage? It contain almost everithing, except
detailed examples...

>ability to test rules (it's hard to reproduce exact packets and test
>your rules against them) that you have no options other than wondering
>and learning from examples which are, as we found out "are just, ehm,
>examples". :)

For IPv4 only (with TCP it doesn't matter), the hping3 is your friend,
here is unrelated hping3 example, where i reproduced SYN segment
with 12 B zero data (it has many other options):

    hping3 -S -c 1 -d 12 -E /dev/zero ...

happy firewalling
:-)


-- 
Slavko
https://www.slavino.sk/