error using variable for network device name in 'hook ingress device $external_interface'

error using variable for network device name in 'hook ingress device $external_interface'

[Grant C]

Hello,

Is there special syntax required to use a variable name instead of 
hard-coding the interface name in a declaration like the following?

chain blackhole {
   type filter hook ingress device $external_interface priority -500; 
policy accept

Error: syntax error, unexpected '$', expecting string or quoted string 
or string with a trailing asterisk
                 type filter hook ingress device $external_interface 
priority -500; policy accept

using the interface name directly instead of the variable works.

Trying the new syntax that allows using a list, 'ingress devices = { }' 
also fails when using a variable either inside an anonymous list, or as 
the name of a named list.


I am using nftables 9.3 from Debian Buster backports.

Re: error using variable for network device name in 'hook ingress device $external_interface'

[Daniel]

Hello

Le 17/08/2020 à 02:23, Grant C a écrit :
> Hello,
>
> Is there special syntax required to use a variable name instead of 
> hard-coding the interface name in a declaration like the following?
>
> chain blackhole {
>   type filter hook ingress device $external_interface priority -500; 
> policy accept
>
> Error: syntax error, unexpected '$', expecting string or quoted string 
> or string with a trailing asterisk
>                 type filter hook ingress device $external_interface 
> priority -500; policy accept
>
> using the interface name directly instead of the variable works.
Try chain blackhole "{
   type filter hook ingress device $external_interface priority -500; 
policy accept }"

>
> Trying the new syntax that allows using a list, 'ingress devices = { 
> }' also fails when using a variable either inside an anonymous list, 
> or as the name of a named list.
>
>
> I am using nftables 9.3 from Debian Buster backports.

-- 
Daniel Huhardeaux
+33.368460088@tootai.net	      sip:820@sip.tootai.net
+41.445532125@swiss-itech.ch		    tootaiNET

Re: error using variable for network device name in 'hook ingress device $external_interface'

[Pablo Neira Ayuso]

On Sun, Aug 16, 2020 at 05:23:38PM -0700, Grant C wrote:
> Hello,
> 
> Is there special syntax required to use a variable name instead of
> hard-coding the interface name in a declaration like the following?
> 
> chain blackhole {
>   type filter hook ingress device $external_interface priority -500; policy
> accept
> 
> Error: syntax error, unexpected '$', expecting string or quoted string or
> string with a trailing asterisk
>                 type filter hook ingress device $external_interface priority -500; policy accept
> 
> using the interface name directly instead of the variable works.
> 
> Trying the new syntax that allows using a list, 'ingress devices = { }' also
> fails when using a variable either inside an anonymous list, or as the name
> of a named list.
> 
> 
> I am using nftables 9.3 from Debian Buster backports.

Support for variable from chain device (as you use above) is available
in the nftables release (or using the current git snapshot), this is a
recent enhancement.

Re: error using variable for network device name in 'hook ingress device $external_interface'

[Pablo Neira Ayuso]

On Mon, Aug 17, 2020 at 11:58:39AM +0200, Pablo Neira Ayuso wrote:
> On Sun, Aug 16, 2020 at 05:23:38PM -0700, Grant C wrote:
> > Hello,
> > 
> > Is there special syntax required to use a variable name instead of
> > hard-coding the interface name in a declaration like the following?
> > 
> > chain blackhole {
> >   type filter hook ingress device $external_interface priority -500; policy
> > accept
> > 
> > Error: syntax error, unexpected '$', expecting string or quoted string or
> > string with a trailing asterisk
> >                 type filter hook ingress device $external_interface priority -500; policy accept
> > 
> > using the interface name directly instead of the variable works.
> > 
> > Trying the new syntax that allows using a list, 'ingress devices = { }' also
> > fails when using a variable either inside an anonymous list, or as the name
> > of a named list.
> > 
> > 
> > I am using nftables 9.3 from Debian Buster backports.
> 
> Support for variable from chain device (as you use above) is available
> in the nftables release (or using the current git snapshot), this is a
> recent enhancement.

... in the _next_ nftables release