named vmaps

named vmaps

[Bjørnar Ness]

Is support for named vmaps removed from nft? Running kernel 3.18.0-rc5
and nft head.

I am able to create the named vmap:

nft add map filter my_vmap { type ipv4_addr : verdict\; }

..but when I try to add elements to it:

nft add element filter my_vmap { 1.0.0.0 : drop}
<cmdline>:1:40-43: Error: syntax error, unexpected drop
add element filter my_vmap { 1.0.0.0 : drop}
                                       ^^^^

also, when trying to use the vmap in a rule:

nft add rule filter input ip saddr vmap @my_vmap
<cmdline>:1:37-37: Error: syntax error, unexpected @, expecting '{'
add rule filter input ip saddr vmap @my_vmap

Dont find anything in "documentation" or online that tells me if and when this
functionality changed/broke/got removed.

-- 
Bj(/)rnar

Re: named vmaps

[Pablo Neira Ayuso]

On Fri, Nov 21, 2014 at 09:22:00AM +0100, Bjørnar Ness wrote:
> Is support for named vmaps removed from nft? Running kernel 3.18.0-rc5
> and nft head.
> 
> I am able to create the named vmap:
> 
> nft add map filter my_vmap { type ipv4_addr : verdict\; }
> 
> ..but when I try to add elements to it:
> 
> nft add element filter my_vmap { 1.0.0.0 : drop}
> <cmdline>:1:40-43: Error: syntax error, unexpected drop
> add element filter my_vmap { 1.0.0.0 : drop}
>                                        ^^^^
> 
> also, when trying to use the vmap in a rule:
> 
> nft add rule filter input ip saddr vmap @my_vmap
> <cmdline>:1:37-37: Error: syntax error, unexpected @, expecting '{'
> add rule filter input ip saddr vmap @my_vmap

Sent you several patches, please confirm this resolves your problems.

> Dont find anything in "documentation" or online that tells me if and when this
> functionality changed/broke/got removed.

I have updated the documentation:

http://wiki.nftables.org/wiki-nftables/index.php/Dictionaries

Please, let me know if you find any mistake on it. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: named vmaps

[Bjørnar Ness]

2014-11-24 12:55 GMT+01:00 Pablo Neira Ayuso <pablo@netfilter.org>:
> On Fri, Nov 21, 2014 at 09:22:00AM +0100, Bjørnar Ness wrote:
>> Is support for named vmaps removed from nft? Running kernel 3.18.0-rc5
>> [ ... ]
>
> I have updated the documentation:
>
> http://wiki.nftables.org/wiki-nftables/index.php/Dictionaries
>
> Please, let me know if you find any mistake on it. Thanks.

This works, thanks Pablo!

A few comments, tho:

Is it possible/planned to make counters work with sets/vmaps?

nft add rule filter input ip saddr vmap @my_vmap counter

will not work since it counts too late (never)

Is the following planned:
1) individual element counters
2) comments for elements
3) element timeout

Also, negative set/vmap lookup does not seem to work, I would like the
following functionality

nft insert rule filter forward ip saddr !@ignorelist ip saddr @blocklist drop

Best regards,

-- 
Bj(/)rnar
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: named vmaps

[Pablo Neira Ayuso]

On Mon, Nov 24, 2014 at 08:03:16PM +0100, Bjørnar Ness wrote:
> 2014-11-24 12:55 GMT+01:00 Pablo Neira Ayuso <pablo@netfilter.org>:
> > On Fri, Nov 21, 2014 at 09:22:00AM +0100, Bjørnar Ness wrote:
> >> Is support for named vmaps removed from nft? Running kernel 3.18.0-rc5
> >> [ ... ]
> >
> > I have updated the documentation:
> >
> > http://wiki.nftables.org/wiki-nftables/index.php/Dictionaries
> >
> > Please, let me know if you find any mistake on it. Thanks.
> 
> This works, thanks Pablo!
> 
> A few comments, tho:
> 
> Is it possible/planned to make counters work with sets/vmaps?
> 
> nft add rule filter input ip saddr vmap @my_vmap counter
>
> will not work since it counts too late (never)

vmap is terminal, nft should spot an error with that rule.

What would you like to achieve with that 'counter'? Count packets that
are look up in the set/vmap?

> Is the following planned:
> 1) individual element counters
> 2) comments for elements
> 3) element timeout

Those can be implemented, yes.

> Also, negative set/vmap lookup does not seem to work, I would like the
> following functionality
> 
> nft insert rule filter forward ip saddr !@ignorelist ip saddr @blocklist drop

Negative set lookup is relatively easy to implement, we'll have this
soon.

Negative vmap lookup, I don't see at this moment how this can be
useful.

Thanks for testing.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html