"include" directive should skip broken symlinks?

"Willow Barraco" <[email protected]> Sat, 28 Feb 2026 16:03:42 +0100
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
Hey there,

At Alpine Linux, we embark a default nftables configurations containing
this line:

	include "/etc/nftables.d/*.nft"

Then, we have a meta package, and related sub-packages containing
holes on the firewall, related to their package. By example, a user
using nftables, and installing "nftables-rulesets" and "syncthing"
would install a dedicated ruleset installed at this location
"usr/share/nftables.avail/50_syncthing.nft". The users then can either
copy or symlink this to /etc/nftables.d/.

Now the problem: When the user symlink this, and then uninstall
the package, the symlink is left broken. In that situation, nftables
can't start, and the service generally silently remains as crashed on
system restarts.

I'm not sure what is the best way for nftables to handle this. Probably
it should skip this included entry? But this could lead to
unpredictable behaviors. Or maybe there should be a "include_if"
alternative config entry, to skip unreadable files?

Thanks,
Willow