* [nftables] sets update concatenation?
@ 2020-09-25 19:10 ѽ҉ᶬḳ℠
2020-09-26 18:21 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: ѽ҉ᶬḳ℠ @ 2020-09-25 19:10 UTC (permalink / raw)
To: netfilter@vger.kernel.org
Been trying to concatenate sets update:
tcp dport @b_t update @b_sa4 { ip saddr } drop;
tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
with:
tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
but that did not work out. Is somehow possible to concatenate sets update?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation?
2020-09-25 19:10 [nftables] sets update concatenation? ѽ҉ᶬḳ℠
@ 2020-09-26 18:21 ` Pablo Neira Ayuso
2020-09-26 18:44 ` ѽ҉ᶬḳ℠
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2020-09-26 18:21 UTC (permalink / raw)
To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org
On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> Been trying to concatenate sets update:
>
> tcp dport @b_t update @b_sa4 { ip saddr } drop;
> tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
>
> with:
>
> tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
What's the intention here?
> but that did not work out. Is somehow possible to concatenate sets update?
Yes, you can do:
tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop
You can update one single set at a time. Not sure what you expect from
this concatenating sets instead of keys.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation?
2020-09-26 18:21 ` Pablo Neira Ayuso
@ 2020-09-26 18:44 ` ѽ҉ᶬḳ℠
2020-09-26 19:07 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: ѽ҉ᶬḳ℠ @ 2020-09-26 18:44 UTC (permalink / raw)
To: netfilter@vger.kernel.org
On 26/09/2020 20:21, Pablo Neira Ayuso wrote:
> On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
>> Been trying to concatenate sets update:
>>
>> tcp dport @b_t update @b_sa4 { ip saddr } drop;
>> tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
>>
>> with:
>>
>> tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
> What's the intention here?
>
>> but that did not work out. Is somehow possible to concatenate sets update?
> Yes, you can do:
>
> tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop
>
> You can update one single set at a time. Not sure what you expect from
> this concatenating sets instead of keys.
The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits
on tcp dport.
The intended concatenation was to put it into one rule instead of two,
like if ip saddr then update element in set @b_sa4 and if ip6 saddr then
update element in set @b_sa6 respectively.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation?
2020-09-26 18:44 ` ѽ҉ᶬḳ℠
@ 2020-09-26 19:07 ` Pablo Neira Ayuso
2020-09-26 19:21 ` ѽ҉ᶬḳ℠
0 siblings, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2020-09-26 19:07 UTC (permalink / raw)
To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org
On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote:
>
> On 26/09/2020 20:21, Pablo Neira Ayuso wrote:
> > On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > Been trying to concatenate sets update:
> > >
> > > tcp dport @b_t update @b_sa4 { ip saddr } drop;
> > > tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
> > >
> > > with:
> > >
> > > tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
> > What's the intention here?
> >
> > > but that did not work out. Is somehow possible to concatenate sets update?
> > Yes, you can do:
> >
> > tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop
> >
> > You can update one single set at a time. Not sure what you expect from
> > this concatenating sets instead of keys.
>
> The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on
> tcp dport.
>
> The intended concatenation was to put it into one rule instead of two, like
> if ip saddr then update element in set @b_sa4 and if ip6 saddr then update
> element in set @b_sa6 respectively.
So you would like to consolidate:
tcp dport @b_t update @b_sa4 { ip saddr } drop
tcp dport @b_t update @b_sa6 { ip6 saddr } drop
In one single rule?
Something like (hypothetical syntax)
tcp dport @b_t update @b_sa { inet saddr } drop
where b_sa is a set with something like type inet_addr.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation?
2020-09-26 19:07 ` Pablo Neira Ayuso
@ 2020-09-26 19:21 ` ѽ҉ᶬḳ℠
2020-09-26 19:47 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: ѽ҉ᶬḳ℠ @ 2020-09-26 19:21 UTC (permalink / raw)
To: netfilter@vger.kernel.org
On 26/09/2020 21:07, Pablo Neira Ayuso wrote:
> On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote:
>> On 26/09/2020 20:21, Pablo Neira Ayuso wrote:
>>> On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
>>>> Been trying to concatenate sets update:
>>>>
>>>> tcp dport @b_t update @b_sa4 { ip saddr } drop;
>>>> tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
>>>>
>>>> with:
>>>>
>>>> tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
>>> What's the intention here?
>>>
>>>> but that did not work out. Is somehow possible to concatenate sets update?
>>> Yes, you can do:
>>>
>>> tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop
>>>
>>> You can update one single set at a time. Not sure what you expect from
>>> this concatenating sets instead of keys.
>> The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on
>> tcp dport.
>>
>> The intended concatenation was to put it into one rule instead of two, like
>> if ip saddr then update element in set @b_sa4 and if ip6 saddr then update
>> element in set @b_sa6 respectively.
> So you would like to consolidate:
>
> tcp dport @b_t update @b_sa4 { ip saddr } drop
> tcp dport @b_t update @b_sa6 { ip6 saddr } drop
>
> In one single rule?
>
> Something like (hypothetical syntax)
>
> tcp dport @b_t update @b_sa { inet saddr } drop
>
> where b_sa is a set with something like type inet_addr.
In a way yes, though this would consolidate also ip and ip6 into the
same set and could make viewing (a large) set it bit cumbersome, unless
there was an optional view filter something like
nft list set [family] [table] filter [set] ( optional [ip] | [ip6] )
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [nftables] sets update concatenation?
2020-09-26 19:21 ` ѽ҉ᶬḳ℠
@ 2020-09-26 19:47 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2020-09-26 19:47 UTC (permalink / raw)
To: ѽ҉ᶬḳ℠; +Cc: netfilter@vger.kernel.org
On Sat, Sep 26, 2020 at 07:21:00PM +0000, ѽ҉ᶬḳ℠ wrote:
>
> On 26/09/2020 21:07, Pablo Neira Ayuso wrote:
> > On Sat, Sep 26, 2020 at 06:44:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > On 26/09/2020 20:21, Pablo Neira Ayuso wrote:
> > > > On Fri, Sep 25, 2020 at 07:10:00PM +0000, ѽ҉ᶬḳ℠ wrote:
> > > > > Been trying to concatenate sets update:
> > > > >
> > > > > tcp dport @b_t update @b_sa4 { ip saddr } drop;
> > > > > tcp dport @b_t update @b_sa6 { ip6 saddr } drop;
> > > > >
> > > > > with:
> > > > >
> > > > > tcp dport @b_t update @b_sa4 . @b_sa4 { ip saddr . ip6 saddr } drop;
> > > > What's the intention here?
> > > >
> > > > > but that did not work out. Is somehow possible to concatenate sets update?
> > > > Yes, you can do:
> > > >
> > > > tcp dport @b_t update @b_sa4 { ip saddr . ip6 saddr } drop
> > > >
> > > > You can update one single set at a time. Not sure what you expect from
> > > > this concatenating sets instead of keys.
> > > The two mentioned sets are dynamic, learning ip | ip6 saddrs from hits on
> > > tcp dport.
> > >
> > > The intended concatenation was to put it into one rule instead of two, like
> > > if ip saddr then update element in set @b_sa4 and if ip6 saddr then update
> > > element in set @b_sa6 respectively.
> > So you would like to consolidate:
> >
> > tcp dport @b_t update @b_sa4 { ip saddr } drop
> > tcp dport @b_t update @b_sa6 { ip6 saddr } drop
> >
> > In one single rule?
> >
> > Something like (hypothetical syntax)
> >
> > tcp dport @b_t update @b_sa { inet saddr } drop
> >
> > where b_sa is a set with something like type inet_addr.
>
> In a way yes, though this would consolidate also ip and ip6 into the same
> set and could make viewing (a large) set it bit cumbersome, unless there was
> an optional view filter something like
>
> nft list set [family] [table] filter [set] ( optional [ip] | [ip6] )
General set infrastructure that provides an abstraction for IPv4 and
IPv6 through inet is possible, yes.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-09-26 19:47 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-25 19:10 [nftables] sets update concatenation? ѽ҉ᶬḳ℠
2020-09-26 18:21 ` Pablo Neira Ayuso
2020-09-26 18:44 ` ѽ҉ᶬḳ℠
2020-09-26 19:07 ` Pablo Neira Ayuso
2020-09-26 19:21 ` ѽ҉ᶬḳ℠
2020-09-26 19:47 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox