From: Vladimir Nikishkin <lockywolf@gmail.com>
To: netfilter@vger.kernel.org
Subject: Matching metainformation cgroup fails on input, works on output.
Date: Wed, 08 Dec 2021 17:07:39 +0800 [thread overview]
Message-ID: <874k7j31no.fsf@laptop.lockywolf.net> (raw)
Hello, everyone.
I have a weird problem!
This is my nft code:
```
nft add counter filter test-icmp-output
nft add counter filter test-icmp-input
nft add rule filter OUTPUT meta cgroup != 0x001000 ip daddr 8.8.8.8 ip protocol icmp counter name test-icmp-output
nft add rule filter INPUT meta cgroup != 0x001000 ip saddr 8.8.8.8 ip protocol icmp counter name test-icmp-input
```
Pinging 8.8.8.8 works. The packets are visible on tcpdump too.
The cgroup id 0x001000 does not exist, so every packet should match.
Still, the output counter counts the expected number of packets, the
second stays 0.
What am I doing wrong?
--
Your sincerely,
Vladimir Nikishkin (MiEr, lockywolf)
(Laptop)
next reply other threads:[~2021-12-08 9:07 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-08 9:07 Vladimir Nikishkin [this message]
2021-12-08 14:07 ` Matching metainformation cgroup fails on input, works on output Martin Gignac
2021-12-08 14:17 ` Vladimir Nikishkin
2021-12-08 14:51 ` Martin Gignac
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874k7j31no.fsf@laptop.lockywolf.net \
--to=lockywolf@gmail.com \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.