* ingress hook on interface with multiple addresses ?
@ 2020-08-12 15:41 sean darcy
2020-08-12 20:57 ` Florian Westphal
0 siblings, 1 reply; 6+ messages in thread
From: sean darcy @ 2020-08-12 15:41 UTC (permalink / raw)
To: netfilter
I have an interface with 2 ip addresses:
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
group default qlen 1000
............
2: enp1s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel
state UP group default qlen 1000
link/ether 98:29:a6:48:49:8e brd ff:ff:ff:ff:ff:ff
inet 10.0.0.61/24 brd 10.0.0.255 scope global noprefixroute enp1s0f1
valid_lft forever preferred_lft forever
inet 10.0.0.2/32 scope global noprefixroute enp1s0f1
valid_lft forever preferred_lft forever
When I try to add a chain on ingress hook, nft is unhappy:
nft list table netdev foo
table netdev foo {
set allowlist {
type ipv4_addr
flags interval
auto-merge
elements = { 10.0.0.0/8, 127.0.0.1 }
}
}
nft 'add chain netdev foo dev0filter { type filter hook ingress device
enp1s0f1 priority 0 ; }'
Error: Could not process rule: No such file or directory
add chain netdev foo dev0filter { type filter hook ingress device
enp1s0f1 priority 0 ; }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Can you have a chain on ingress hook for an interface that has multiple
addresses ? If so, how?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: ingress hook on interface with multiple addresses ?
2020-08-12 15:41 ingress hook on interface with multiple addresses ? sean darcy
@ 2020-08-12 20:57 ` Florian Westphal
2020-08-12 21:30 ` sean darcy
0 siblings, 1 reply; 6+ messages in thread
From: Florian Westphal @ 2020-08-12 20:57 UTC (permalink / raw)
To: sean darcy; +Cc: netfilter
sean darcy <seandarcy2@gmail.com> wrote:
> I have an interface with 2 ip addresses:
>
> ip a
> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
> default qlen 1000
> ............
> 2: enp1s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
> UP group default qlen 1000
> link/ether 98:29:a6:48:49:8e brd ff:ff:ff:ff:ff:ff
> inet 10.0.0.61/24 brd 10.0.0.255 scope global noprefixroute enp1s0f1
> valid_lft forever preferred_lft forever
> inet 10.0.0.2/32 scope global noprefixroute enp1s0f1
> valid_lft forever preferred_lft forever
>
> When I try to add a chain on ingress hook, nft is unhappy:
>
> nft list table netdev foo
> table netdev foo {
> set allowlist {
> type ipv4_addr
> flags interval
> auto-merge
> elements = { 10.0.0.0/8, 127.0.0.1 }
> }
> }
>
>
> nft 'add chain netdev foo dev0filter { type filter hook ingress device
> enp1s0f1 priority 0 ; }'
> Error: Could not process rule: No such file or directory
> add chain netdev foo dev0filter { type filter hook ingress device enp1s0f1
> priority 0 ; }
works fine for me on 5.7.11 kernel (with adjusted interface name).
> Can you have a chain on ingress hook for an interface that has multiple
> addresses ?
Its not relevant how many addresses are assigned.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: ingress hook on interface with multiple addresses ?
2020-08-12 20:57 ` Florian Westphal
@ 2020-08-12 21:30 ` sean darcy
2020-08-12 22:03 ` Florian Westphal
0 siblings, 1 reply; 6+ messages in thread
From: sean darcy @ 2020-08-12 21:30 UTC (permalink / raw)
To: netfilter
On 8/12/20 4:57 PM, Florian Westphal wrote:
> sean darcy <seandarcy2@gmail.com> wrote:
>> I have an interface with 2 ip addresses:
>>
>> ip a
>> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
>> default qlen 1000
>> ............
>> 2: enp1s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
>> UP group default qlen 1000
>> link/ether 98:29:a6:48:49:8e brd ff:ff:ff:ff:ff:ff
>> inet 10.0.0.61/24 brd 10.0.0.255 scope global noprefixroute enp1s0f1
>> valid_lft forever preferred_lft forever
>> inet 10.0.0.2/32 scope global noprefixroute enp1s0f1
>> valid_lft forever preferred_lft forever
>>
>> When I try to add a chain on ingress hook, nft is unhappy:
>>
>> nft list table netdev foo
>> table netdev foo {
>> set allowlist {
>> type ipv4_addr
>> flags interval
>> auto-merge
>> elements = { 10.0.0.0/8, 127.0.0.1 }
>> }
>> }
>>
>>
>> nft 'add chain netdev foo dev0filter { type filter hook ingress device
>> enp1s0f1 priority 0 ; }'
>> Error: Could not process rule: No such file or directory
>> add chain netdev foo dev0filter { type filter hook ingress device enp1s0f1
>> priority 0 ; }
>
> works fine for me on 5.7.11 kernel (with adjusted interface name).
>
>> Can you have a chain on ingress hook for an interface that has multiple
>> addresses ?
>
> Its not relevant how many addresses are assigned.
>
I'm on Fedora 32:
5.7.14-200.fc32.
rpm -q nftables libnftnl
nftables-0.9.3-3.fc32.x86_64
libnftnl-1.1.5-2.fc32.x86_64
I see nftables is now at 0.9.6 and libnftnl is at 1.1.7. What versions
are you using?
I'll try to upgrade and see if that works.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: ingress hook on interface with multiple addresses ?
2020-08-12 21:30 ` sean darcy
@ 2020-08-12 22:03 ` Florian Westphal
2020-08-13 0:54 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: Florian Westphal @ 2020-08-12 22:03 UTC (permalink / raw)
To: sean darcy; +Cc: netfilter
sean darcy <seandarcy2@gmail.com> wrote:
> On 8/12/20 4:57 PM, Florian Westphal wrote:
> > sean darcy <seandarcy2@gmail.com> wrote:
> > > I have an interface with 2 ip addresses:
> > >
> > > ip a
> > > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
> > > default qlen 1000
> > > ............
> > > 2: enp1s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
> > > UP group default qlen 1000
> > > link/ether 98:29:a6:48:49:8e brd ff:ff:ff:ff:ff:ff
> > > inet 10.0.0.61/24 brd 10.0.0.255 scope global noprefixroute enp1s0f1
> > > valid_lft forever preferred_lft forever
> > > inet 10.0.0.2/32 scope global noprefixroute enp1s0f1
> > > valid_lft forever preferred_lft forever
> > >
> > > When I try to add a chain on ingress hook, nft is unhappy:
> > >
> > > nft list table netdev foo
> > > table netdev foo {
> > > set allowlist {
> > > type ipv4_addr
> > > flags interval
> > > auto-merge
> > > elements = { 10.0.0.0/8, 127.0.0.1 }
> > > }
> > > }
> > >
> > >
> > > nft 'add chain netdev foo dev0filter { type filter hook ingress device
> > > enp1s0f1 priority 0 ; }'
> > > Error: Could not process rule: No such file or directory
> > > add chain netdev foo dev0filter { type filter hook ingress device enp1s0f1
> > > priority 0 ; }
> >
> > works fine for me on 5.7.11 kernel (with adjusted interface name).
> >
> > > Can you have a chain on ingress hook for an interface that has multiple
> > > addresses ?
> >
> > Its not relevant how many addresses are assigned.
> >
> I'm on Fedora 32:
>
> 5.7.14-200.fc32.
> rpm -q nftables libnftnl
> nftables-0.9.3-3.fc32.x86_64
> libnftnl-1.1.5-2.fc32.x86_64
Exact same versions here:
libnftnl-1.1.5-2.fc32.x86_64
nftables-0.9.3-3.fc32.x86_64
I will do a kernel update and see if that breaks it.
I get the same error message if I mistype the device name, but it looks
like thats not it as per your "ip a" output.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: ingress hook on interface with multiple addresses ?
2020-08-12 22:03 ` Florian Westphal
@ 2020-08-13 0:54 ` Pablo Neira Ayuso
2020-08-13 21:14 ` sean darcy
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2020-08-13 0:54 UTC (permalink / raw)
To: Florian Westphal; +Cc: sean darcy, netfilter
On Thu, Aug 13, 2020 at 12:03:05AM +0200, Florian Westphal wrote:
> sean darcy <seandarcy2@gmail.com> wrote:
> > On 8/12/20 4:57 PM, Florian Westphal wrote:
> > > sean darcy <seandarcy2@gmail.com> wrote:
> > > > I have an interface with 2 ip addresses:
> > > >
> > > > ip a
> > > > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
> > > > default qlen 1000
> > > > ............
> > > > 2: enp1s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
> > > > UP group default qlen 1000
> > > > link/ether 98:29:a6:48:49:8e brd ff:ff:ff:ff:ff:ff
> > > > inet 10.0.0.61/24 brd 10.0.0.255 scope global noprefixroute enp1s0f1
> > > > valid_lft forever preferred_lft forever
> > > > inet 10.0.0.2/32 scope global noprefixroute enp1s0f1
> > > > valid_lft forever preferred_lft forever
> > > >
> > > > When I try to add a chain on ingress hook, nft is unhappy:
> > > >
> > > > nft list table netdev foo
> > > > table netdev foo {
> > > > set allowlist {
> > > > type ipv4_addr
> > > > flags interval
> > > > auto-merge
> > > > elements = { 10.0.0.0/8, 127.0.0.1 }
> > > > }
> > > > }
> > > >
> > > >
> > > > nft 'add chain netdev foo dev0filter { type filter hook ingress device
> > > > enp1s0f1 priority 0 ; }'
> > > > Error: Could not process rule: No such file or directory
> > > > add chain netdev foo dev0filter { type filter hook ingress device enp1s0f1
> > > > priority 0 ; }
> > >
> > > works fine for me on 5.7.11 kernel (with adjusted interface name).
> > >
> > > > Can you have a chain on ingress hook for an interface that has multiple
> > > > addresses ?
> > >
> > > Its not relevant how many addresses are assigned.
> > >
> > I'm on Fedora 32:
> >
> > 5.7.14-200.fc32.
> > rpm -q nftables libnftnl
> > nftables-0.9.3-3.fc32.x86_64
> > libnftnl-1.1.5-2.fc32.x86_64
>
> Exact same versions here:
> libnftnl-1.1.5-2.fc32.x86_64
> nftables-0.9.3-3.fc32.x86_64
>
> I will do a kernel update and see if that breaks it.
> I get the same error message if I mistype the device name, but it looks
> like thats not it as per your "ip a" output.
Probably this patch is missing in nftables-0.9.3-3.fc32.x86_64 ?
commit 78bbe7f7a55be48909067e25900de27623d8fa6a
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Wed Feb 19 21:05:26 2020 +0100
mnl: do not use expr->identifier to fetch device name
This string might not be nul-terminated, resulting in spurious errors
when adding netdev chains.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: ingress hook on interface with multiple addresses ?
2020-08-13 0:54 ` Pablo Neira Ayuso
@ 2020-08-13 21:14 ` sean darcy
0 siblings, 0 replies; 6+ messages in thread
From: sean darcy @ 2020-08-13 21:14 UTC (permalink / raw)
To: netfilter
On 8/12/20 8:54 PM, Pablo Neira Ayuso wrote:
> On Thu, Aug 13, 2020 at 12:03:05AM +0200, Florian Westphal wrote:
>> sean darcy <seandarcy2@gmail.com> wrote:
>>> On 8/12/20 4:57 PM, Florian Westphal wrote:
>>>> sean darcy <seandarcy2@gmail.com> wrote:
>>>>> I have an interface with 2 ip addresses:
>>>>>
>>>>> ip a
>>>>> 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group
>>>>> default qlen 1000
>>>>> ............
>>>>> 2: enp1s0f1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state
>>>>> UP group default qlen 1000
>>>>> link/ether 98:29:a6:48:49:8e brd ff:ff:ff:ff:ff:ff
>>>>> inet 10.0.0.61/24 brd 10.0.0.255 scope global noprefixroute enp1s0f1
>>>>> valid_lft forever preferred_lft forever
>>>>> inet 10.0.0.2/32 scope global noprefixroute enp1s0f1
>>>>> valid_lft forever preferred_lft forever
>>>>>
>>>>> When I try to add a chain on ingress hook, nft is unhappy:
>>>>>
>>>>> nft list table netdev foo
>>>>> table netdev foo {
>>>>> set allowlist {
>>>>> type ipv4_addr
>>>>> flags interval
>>>>> auto-merge
>>>>> elements = { 10.0.0.0/8, 127.0.0.1 }
>>>>> }
>>>>> }
>>>>>
>>>>>
>>>>> nft 'add chain netdev foo dev0filter { type filter hook ingress device
>>>>> enp1s0f1 priority 0 ; }'
>>>>> Error: Could not process rule: No such file or directory
>>>>> add chain netdev foo dev0filter { type filter hook ingress device enp1s0f1
>>>>> priority 0 ; }
>>>>
>>>> works fine for me on 5.7.11 kernel (with adjusted interface name).
>>>>
>>>>> Can you have a chain on ingress hook for an interface that has multiple
>>>>> addresses ?
>>>>
>>>> Its not relevant how many addresses are assigned.
>>>>
>>> I'm on Fedora 32:
>>>
>>> 5.7.14-200.fc32.
>>> rpm -q nftables libnftnl
>>> nftables-0.9.3-3.fc32.x86_64
>>> libnftnl-1.1.5-2.fc32.x86_64
>>
>> Exact same versions here:
>> libnftnl-1.1.5-2.fc32.x86_64
>> nftables-0.9.3-3.fc32.x86_64
>>
>> I will do a kernel update and see if that breaks it.
>> I get the same error message if I mistype the device name, but it looks
>> like thats not it as per your "ip a" output.
>
> Probably this patch is missing in nftables-0.9.3-3.fc32.x86_64 ?
>
> commit 78bbe7f7a55be48909067e25900de27623d8fa6a
> Author: Pablo Neira Ayuso <pablo@netfilter.org>
> Date: Wed Feb 19 21:05:26 2020 +0100
>
> mnl: do not use expr->identifier to fetch device name
>
> This string might not be nul-terminated, resulting in spurious errors
> when adding netdev chains.
>
That may be. In any event, I made rpm packages of :
nftables-0.9.6-0.fc32.x86_64
libnftnl-1.1.7-3.fc32.x86_64
And now it works !!!
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-08-13 21:14 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-08-12 15:41 ingress hook on interface with multiple addresses ? sean darcy
2020-08-12 20:57 ` Florian Westphal
2020-08-12 21:30 ` sean darcy
2020-08-12 22:03 ` Florian Westphal
2020-08-13 0:54 ` Pablo Neira Ayuso
2020-08-13 21:14 ` sean darcy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox