* [nftables] sets update concatenation?
@ 2020-09-25 19:10 ѽ҉ᶬḳ℠
2020-09-26 18:21 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: ѽ҉ᶬḳ℠ @ 2020-09-25 19:10 UTC (permalink / raw)
To: netfilter@vger.kernel.org
Been trying to concatenate sets update:
tcp dport @b_t update @b_sa4 { ip saddr } drop;
tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
with:
tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
but that did not work out. Is somehow possible to concatenate sets update?
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [nftables] sets update concatenation? 2020-09-25 19:10 [nftables] sets update concatenation? ѽ҉ᶬḳ℠ @ 2020-09-26 18:21 ` Pablo Neira Ayuso 2020-09-26 18:44 ` ѽ҉ᶬḳ℠ 0 siblings, 1 reply; 6+ messages in thread From: Pablo Neira Ayuso @ 2020-09-26 18:21 UTC (permalink / raw) To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote: > Been trying to concatenate sets update: > > tcp dport @b_t update @b_sa4 { ip saddr } drop; > tcp dport @b_t update @b_sa6 { ip6 saddr } drop; > > with: > > tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop; What's the intention here? > but that did not work out. Is somehow possible to concatenate sets update? Yes, you can do: tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop You can update one single set at a time. Not sure what you expect from this concatenating sets instead of keys. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation? 2020-09-26 18:21 ` Pablo Neira Ayuso @ 2020-09-26 18:44 ` ѽ҉ᶬḳ℠ 2020-09-26 19:07 ` Pablo Neira Ayuso 0 siblings, 1 reply; 6+ messages in thread From: ѽ҉ᶬḳ℠ @ 2020-09-26 18:44 UTC (permalink / raw) To: netfilter@vger.kernel.org On 26/09/2020 20:21, Pablo Neira Ayuso wrote: > On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote: >> Been trying to concatenate sets update: >> >> tcp dport @b_t update @b_sa4 { ip saddr } drop; >> tcp dport @b_t update @b_sa6 { ip6 saddr } drop; >> >> with: >> >> tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop; > What's the intention here? > >> but that did not work out. Is somehow possible to concatenate sets update? > Yes, you can do: > > tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop > > You can update one single set at a time. Not sure what you expect from > this concatenating sets instead of keys. The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on tcp dport. The intended concatenation was to put it into one rule instead of two, like if ip saddr then update element in set @b_sa4 and if ip6 saddr then update element in set @b_sa6 respectively. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation? 2020-09-26 18:44 ` ѽ҉ᶬḳ℠ @ 2020-09-26 19:07 ` Pablo Neira Ayuso 2020-09-26 19:21 ` ѽ҉ᶬḳ℠ 0 siblings, 1 reply; 6+ messages in thread From: Pablo Neira Ayuso @ 2020-09-26 19:07 UTC (permalink / raw) To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote: > > On 26/09/2020 20:21, Pablo Neira Ayuso wrote: > > On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote: > > > Been trying to concatenate sets update: > > > > > > tcp dport @b_t update @b_sa4 { ip saddr } drop; > > > tcp dport @b_t update @b_sa6 { ip6 saddr } drop; > > > > > > with: > > > > > > tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop; > > What's the intention here? > > > > > but that did not work out. Is somehow possible to concatenate sets update? > > Yes, you can do: > > > > tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop > > > > You can update one single set at a time. Not sure what you expect from > > this concatenating sets instead of keys. > > The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on > tcp dport. > > The intended concatenation was to put it into one rule instead of two, like > if ip saddr then update element in set @b_sa4 and if ip6 saddr then update > element in set @b_sa6 respectively. So you would like to consolidate: tcp dport @b_t update @b_sa4 { ip saddr } drop tcp dport @b_t update @b_sa6 { ip6 saddr } drop In one single rule? Something like (hypothetical syntax) tcp dport @b_t update @b_sa { inet saddr } drop where b_sa is a set with something like type inet_addr. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation? 2020-09-26 19:07 ` Pablo Neira Ayuso @ 2020-09-26 19:21 ` ѽ҉ᶬḳ℠ 2020-09-26 19:47 ` Pablo Neira Ayuso 0 siblings, 1 reply; 6+ messages in thread From: ѽ҉ᶬḳ℠ @ 2020-09-26 19:21 UTC (permalink / raw) To: netfilter@vger.kernel.org On 26/09/2020 21:07, Pablo Neira Ayuso wrote: > On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote: >> On 26/09/2020 20:21, Pablo Neira Ayuso wrote: >>> On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote: >>>> Been trying to concatenate sets update: >>>> >>>> tcp dport @b_t update @b_sa4 { ip saddr } drop; >>>> tcp dport @b_t update @b_sa6 { ip6 saddr } drop; >>>> >>>> with: >>>> >>>> tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop; >>> What's the intention here? >>> >>>> but that did not work out. Is somehow possible to concatenate sets update? >>> Yes, you can do: >>> >>> tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop >>> >>> You can update one single set at a time. Not sure what you expect from >>> this concatenating sets instead of keys. >> The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on >> tcp dport. >> >> The intended concatenation was to put it into one rule instead of two, like >> if ip saddr then update element in set @b_sa4 and if ip6 saddr then update >> element in set @b_sa6 respectively. > So you would like to consolidate: > > tcp dport @b_t update @b_sa4 { ip saddr } drop > tcp dport @b_t update @b_sa6 { ip6 saddr } drop > > In one single rule? > > Something like (hypothetical syntax) > > tcp dport @b_t update @b_sa { inet saddr } drop > > where b_sa is a set with something like type inet_addr. In a way yes, though this would consolidate also ip and ip6 into the same set and could make viewing (a large) set it bit cumbersome, unless there was an optional view filter something like nft list set [family] [table] filter [set] ( optional [ip] | [ip6] ) ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation? 2020-09-26 19:21 ` ѽ҉ᶬḳ℠ @ 2020-09-26 19:47 ` Pablo Neira Ayuso 0 siblings, 0 replies; 6+ messages in thread From: Pablo Neira Ayuso @ 2020-09-26 19:47 UTC (permalink / raw) To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org On Sat, Sep 26, 2020 at 07:21:00PM +0000, ѽ҉ᶬḳ℠ wrote: > > On 26/09/2020 21:07, Pablo Neira Ayuso wrote: > > On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote: > > > On 26/09/2020 20:21, Pablo Neira Ayuso wrote: > > > > On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote: > > > > > Been trying to concatenate sets update: > > > > > > > > > > tcp dport @b_t update @b_sa4 { ip saddr } drop; > > > > > tcp dport @b_t update @b_sa6 { ip6 saddr } drop; > > > > > > > > > > with: > > > > > > > > > > tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop; > > > > What's the intention here? > > > > > > > > > but that did not work out. Is somehow possible to concatenate sets update? > > > > Yes, you can do: > > > > > > > > tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop > > > > > > > > You can update one single set at a time. Not sure what you expect from > > > > this concatenating sets instead of keys. > > > The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on > > > tcp dport. > > > > > > The intended concatenation was to put it into one rule instead of two, like > > > if ip saddr then update element in set @b_sa4 and if ip6 saddr then update > > > element in set @b_sa6 respectively. > > So you would like to consolidate: > > > > tcp dport @b_t update @b_sa4 { ip saddr } drop > > tcp dport @b_t update @b_sa6 { ip6 saddr } drop > > > > In one single rule? > > > > Something like (hypothetical syntax) > > > > tcp dport @b_t update @b_sa { inet saddr } drop > > > > where b_sa is a set with something like type inet_addr. > > In a way yes, though this would consolidate also ip and ip6 into the same > set and could make viewing (a large) set it bit cumbersome, unless there was > an optional view filter something like > > nft list set [family] [table] filter [set] ( optional [ip] | [ip6] ) General set infrastructure that provides an abstraction for IPv4 and IPv6 through inet is possible, yes. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-09-26 19:47 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2020-09-25 19:10 [nftables] sets update concatenation? ѽ҉ᶬḳ℠ 2020-09-26 18:21 ` Pablo Neira Ayuso 2020-09-26 18:44 ` ѽ҉ᶬḳ℠ 2020-09-26 19:07 ` Pablo Neira Ayuso 2020-09-26 19:21 ` ѽ҉ᶬḳ℠ 2020-09-26 19:47 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox