* [nftables] possible to utilise sets across different tables?
@ 2020-09-23 11:43 ѽ҉ᶬḳ℠
2020-09-25 9:52 ` ѽ҉ᶬḳ℠
0 siblings, 1 reply; 3+ messages in thread
From: ѽ҉ᶬḳ℠ @ 2020-09-23 11:43 UTC (permalink / raw)
To: netfilter@vger.kernel.org
Would it be possible to generate a set in 'table inet' based on 'saddrÂ
ct state invalid drop' and then utilise the same set in a 'table netdev
rule', for offending saddr getting blocked early?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [nftables] possible to utilise sets across different tables?
2020-09-23 11:43 [nftables] possible to utilise sets across different tables? ѽ҉ᶬḳ℠
@ 2020-09-25 9:52 ` ѽ҉ᶬḳ℠
2020-09-25 12:11 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: ѽ҉ᶬḳ℠ @ 2020-09-25 9:52 UTC (permalink / raw)
To: netfilter@vger.kernel.org
On 23/09/2020 13:43, ѽ҉ᶬḳ℠ wrote:
> Would it be possible to generate a set in 'table inet' based on
> 'saddr ct state invalid drop' and then utilise the same set in a
> 'table netdev rule', for offending saddr getting blocked early?
>
Tried some variations but none worked out and thus it seems deployment
of sets across families is not supported. Though I reckon it would be a
beneficial feature:
* mitigate repetition of same sets that are applicable for different
families
* gather set data in one family, e.g offenders' saddr from inet, and
deploy such set in a rule in a different family, e.g. in netdev for
blocking such offenders early on
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [nftables] possible to utilise sets across different tables?
2020-09-25 9:52 ` ѽ҉ᶬḳ℠
@ 2020-09-25 12:11 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2020-09-25 12:11 UTC (permalink / raw)
To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org
On Fri, Sep 25, 2020 at 09:52:00AM +0000, ѽ҉ᶬḳ℠ wrote:
> On 23/09/2020 13:43, ѽ҉ᶬḳ℠ wrote:
> > Would it be possible to generate a set in 'table inet' based on 'saddr
> > ct state invalid drop' and then utilise the same set in a 'table netdev
> > rule', for offending saddr getting blocked early?
> >
>
> Tried some variations but none worked out and thus it seems deployment of
> sets across families is not supported. Though I reckon it would be a
> beneficial feature:
>
> * mitigate repetition of same sets that are applicable for different
> families
> * gather set data in one family, e.g offenders' saddr from inet, and deploy
> such set in a rule in a different family, e.g. in netdev for blocking such
> offenders early on
This is feasible. I have an incomplete patchset to enable this, I'll
try to scratch some time to finish this.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-09-25 12:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-23 11:43 [nftables] possible to utilise sets across different tables? ѽ҉ᶬḳ℠
2020-09-25 9:52 ` ѽ҉ᶬḳ℠
2020-09-25 12:11 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox