Mask as part of element in set

Mask as part of element in set

[Vlad Tsisyk]

Hello,

I have a set of pairs of MAC address and mask:

aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff
aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
...

I want to apply a mask to source MAC from the packet, and then compare
the result with the MAC from the pair. I can do it like so:

nft add table t
nft add chain t c
nft --debug=netlink add rule ip t c ether saddr and aa:bb:cc:dd:ee:ff
00:ff:ff:ff:ff:00

ip t c
  [ meta load iiftype => reg 1 ]
  [ cmp eq reg 1 0x00000001 ]
  [ payload load 6b @ link header + 6 => reg 1 ]
  [ bitwise reg 1 = (reg=1 & 0xddccbbaa 0x0000ffee ) ^ 0x00000000
0x00000000 ]
  [ cmp eq reg 1 0xffffff00 0x000000ff ]
...

But I have to create a new rule for each pair. Is there any
workarounds to use sets?

Re: Mask as part of element in set

[Pablo Neira Ayuso]

On Wed, Mar 27, 2024 at 03:36:19PM +0700, Vlad Tsisyk wrote:
> Hello,
> 
> I have a set of pairs of MAC address and mask:
> 
> aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff

You would like to match this?

  xx:bb:cc:dd:ee:ff

or mark is reversed?

> aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
>
> ...
> 
> I want to apply a mask to source MAC from the packet, and then compare
> the result with the MAC from the pair. I can do it like so:
> 
> nft add table t
> nft add chain t c
> nft --debug=netlink add rule ip t c ether saddr and aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00

because rule syntax is not correct, mask is reversed:

nft --debug=netlink add rule ip t c ether saddr and 00:ff:ff:ff:ff:00 == aa:bb:cc:dd:ee:ff

that is:

nft --debug=netlink add rule ip t c ether saddr and MASK == VALUE

> ip t c
>   [ meta load iiftype => reg 1 ]
>   [ cmp eq reg 1 0x00000001 ]
>   [ payload load 6b @ link header + 6 => reg 1 ]
>   [ bitwise reg 1 = (reg=1 & 0xddccbbaa 0x0000ffee ) ^ 0x00000000
> 0x00000000 ]
>   [ cmp eq reg 1 0xffffff00 0x000000ff ]
> ...
> 
> But I have to create a new rule for each pair. Is there any
> workarounds to use sets?

You can use ranges in sets.

Re: Mask as part of element in set

[Vlad Tsisyk]

Thank you for your answer!

ср, 27 мар. 2024 г. в 16:16, Pablo Neira Ayuso <pablo@netfilter.org>:
>
> On Wed, Mar 27, 2024 at 03:36:19PM +0700, Vlad Tsisyk wrote:
> > I have a set of pairs of MAC address and mask:
> >
> > aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff
>
> You would like to match this?
>
>   xx:bb:cc:dd:ee:ff

Yes, I want to match those addresses, where the first byte can be anything.

> that is:
>
> nft --debug=netlink add rule ip t c ether saddr and MASK == VALUE

Sorry for my mistake. I swapped MASK and VALUE for no reason.

> > But I have to create a new rule for each pair. Is there any
> > workarounds to use sets?
>
> You can use ranges in sets.

I was thinking about ranges, but ranges will not allow match over LSBs
of MAC ignoring MSBs.