* nftables equivalent of "ipset test"?
@ 2020-03-09 17:53 Frank Myhr
2020-03-09 18:56 ` kfm
2020-03-09 19:14 ` Florian Westphal
0 siblings, 2 replies; 6+ messages in thread
From: Frank Myhr @ 2020-03-09 17:53 UTC (permalink / raw)
To: Linux Netfilter Users List
Is there a recommended way to test whether an element is a member of an
nftables set?
Thanks,
Frank
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nftables equivalent of "ipset test"?
2020-03-09 17:53 nftables equivalent of "ipset test"? Frank Myhr
@ 2020-03-09 18:56 ` kfm
2020-03-09 19:48 ` Frank Myhr
2020-03-09 19:14 ` Florian Westphal
1 sibling, 1 reply; 6+ messages in thread
From: kfm @ 2020-03-09 18:56 UTC (permalink / raw)
To: Linux Netfilter Users List
On 09/03/2020 17:53, Frank Myhr wrote:
> Is there a recommended way to test whether an element is a member of an
> nftables set?
Unfortunately, there doesn't appear to be a straightforward way to
efficiently look up an element in a set from without the ruleset.
One option would be to use the JSON output format. Here is an example of
how it might be done with jshon [1] for a set whose elements contain
just a single data type:-
nft_set_test() {
local val=$1
shift
nft -j list set "$@" |
jshon -e nftables -e 1 -a -e elem -a -u |
grep -qxF "$val"
}
if nft_set_test 1.2.3.4 ip filter myset; then
echo "matched 1.2.3.4"
fi
Where jshon isn't available, jq [2] could be another option.
[1] http://kmkeen.com/jshon/
[2] https://stedolan.github.io/jq/
--
Kerin Millar
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: nftables equivalent of "ipset test"?
2020-03-09 18:56 ` kfm
@ 2020-03-09 19:48 ` Frank Myhr
0 siblings, 0 replies; 6+ messages in thread
From: Frank Myhr @ 2020-03-09 19:48 UTC (permalink / raw)
To: Linux Netfilter Users List
On 2020/03/09 14:56, kfm@plushkava.net wrote:
> One option would be to use the JSON output format. Here is an example of
> how it might be done with jshon [1] for a set whose elements contain
> just a single data type:-
>
> nft_set_test() {
> local val=$1
> shift
> nft -j list set "$@" |
> jshon -e nftables -e 1 -a -e elem -a -u |
> grep -qxF "$val"
> }
>
> if nft_set_test 1.2.3.4 ip filter myset; then
> echo "matched 1.2.3.4"
> fi
>
> Where jshon isn't available, jq [2] could be another option.
>
> [1] http://kmkeen.com/jshon/
> [2] https://stedolan.github.io/jq/
Kerin,
Thank you very much for the link to jshon and even including a sample
script! Debian does have a jshon package available, I imagine I'll find
many uses for it. In this case, I think jshon approach fails for
interval sets when testing for a single element. (Say, test for 10.0.0.7
in set containing 10.0.0.0/8.) Right?
Thanks,
Frank
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: nftables equivalent of "ipset test"?
2020-03-09 17:53 nftables equivalent of "ipset test"? Frank Myhr
2020-03-09 18:56 ` kfm
@ 2020-03-09 19:14 ` Florian Westphal
2020-03-09 19:48 ` Frank Myhr
2020-03-09 19:50 ` kfm
1 sibling, 2 replies; 6+ messages in thread
From: Florian Westphal @ 2020-03-09 19:14 UTC (permalink / raw)
To: Frank Myhr; +Cc: Linux Netfilter Users List
Frank Myhr <fmyhr@fhmtech.com> wrote:
> Is there a recommended way to test whether an element is a member of an
> nftables set?
nft get element inet filter foo "{ 1.2.3.4 }"
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-03-09 19:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-09 17:53 nftables equivalent of "ipset test"? Frank Myhr
2020-03-09 18:56 ` kfm
2020-03-09 19:48 ` Frank Myhr
2020-03-09 19:14 ` Florian Westphal
2020-03-09 19:48 ` Frank Myhr
2020-03-09 19:50 ` kfm
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox