jump to a chain about nftables HOT 5 CLOSED

@stapelberg as per your request, here is a new issue submitted to address jump functionality.

from nftables.

@stapelberg another verdict needed is return:
nft --debug all add rule istio istio_outbound meta skgid 1337 return

| 69 6d 6d 65  |	|      data      |	 i m m e
| 64 69 61 74  |	|      data      |	 d i a t
| 65 00 00 00  |	|      data      |	 e      
|00028|N-|00002|	|len |flags| type|
|00008|--|00001|	|len |flags| type|
| 00 00 00 00  |	|      data      |	        
|00016|N-|00002|	|len |flags| type|
|00012|N-|00002|	|len |flags| type|
|00008|--|00001|	|len |flags| type|
| ff ff ff fb  |	|      data      |	        
----------------	------------------

it could be done with converting -5 into a byte slice but would be nice to have proper interface.

from nftables.

Ah, you’re about to use this package in istio? Can you provide more details about what you’re doing? Just curious :)

Will take a look at this in a bit.

from nftables.

Both fixed now.

from nftables.

@stapelberg thanks for quick fix!! Currently Istio uses iptables in init container. I would like to start first with swapping itables in istio-cni and if it all goes well, I will propose the same change for istio. There are a few things which might be problematic. I will have to make sure ipv6 is supported. Also you do not expose interface in nftables which make a little difficult to do mock. I am building a library with higher level func which will import and use in istio-cni.

from nftables.