Re: [nftables] sets update concatenation?

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> 
> On 26/09/2020 20:21, Pablo Neira Ayuso wrote:
> > On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > Been trying to concatenate sets update:
> > > 
> > > tcp dport @b_t update @b_sa4 { ip saddr } drop;
> > > tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
> > > 
> > > with:
> > > 
> > > tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
> > What's the intention here?
> > 
> > > but that did not work out. Is somehow possible to concatenate sets update?
> > Yes, you can do:
> > 
> > tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop
> > 
> > You can update one single set at a time. Not sure what you expect from
> > this concatenating sets instead of keys.
> 
> The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on
> tcp dport.
> 
> The intended concatenation was to put it into one rule instead of two, like
> if ip saddr then update element in set @b_sa4 and if ip6 saddr then update
> element in set @b_sa6 respectively.

So you would like to consolidate:

 tcp dport @b_t update @b_sa4 { ip saddr } drop
 tcp dport @b_t update @b_sa6 { ip6 saddr } drop

In one single rule?

Something like (hypothetical syntax)

 tcp dport @b_t update @b_sa { inet saddr } drop

where b_sa is a set with something like type inet_addr.