From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Vlad Tsisyk <vlad@tsisyk.com>
Cc: netfilter@vger.kernel.org
Subject: Re: Mask as part of element in set
Date: Wed, 27 Mar 2024 10:16:32 +0100 [thread overview]
Message-ID: <ZgPj8I0MmgAX0O0a@calendula> (raw)
In-Reply-To: <CAOzR2PfY6hY8dqkfWzN2RGG2yU7RR1t-G4d=dqa+7iUy9mjFyw@mail.gmail.com>
On Wed, Mar 27, 2024 at 03:36:19PM +0700, Vlad Tsisyk wrote:
> Hello,
>
> I have a set of pairs of MAC address and mask:
>
> aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff
You would like to match this?
xx:bb:cc:dd:ee:ff
or mark is reversed?
> aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
>
> ...
>
> I want to apply a mask to source MAC from the packet, and then compare
> the result with the MAC from the pair. I can do it like so:
>
> nft add table t
> nft add chain t c
> nft --debug=netlink add rule ip t c ether saddr and aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
because rule syntax is not correct, mask is reversed:
nft --debug=netlink add rule ip t c ether saddr and 00:ff:ff:ff:ff:00 == aa:bb:cc:dd:ee:ff
that is:
nft --debug=netlink add rule ip t c ether saddr and MASK == VALUE
> ip t c
> [ meta load iiftype => reg 1 ]
> [ cmp eq reg 1 0x00000001 ]
> [ payload load 6b @ link header + 6 => reg 1 ]
> [ bitwise reg 1 = (reg=1 & 0xddccbbaa 0x0000ffee ) ^ 0x00000000
> 0x00000000 ]
> [ cmp eq reg 1 0xffffff00 0x000000ff ]
> ...
>
> But I have to create a new rule for each pair. Is there any
> workarounds to use sets?
You can use ranges in sets.
next prev parent reply other threads:[~2024-03-27 9:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-27 8:36 Mask as part of element in set Vlad Tsisyk
2024-03-27 9:16 ` Pablo Neira Ayuso [this message]
2024-03-28 8:20 ` Vlad Tsisyk
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZgPj8I0MmgAX0O0a@calendula \
--to=pablo@netfilter.org \
--cc=netfilter@vger.kernel.org \
--cc=vlad@tsisyk.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.