summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: redirect: fix tests for upcoming nft-test.py fixFlorian Westphal2018-04-017-11/+11
| | | | | | | nft-test.py currently fails to properly compare tests involving a set, after that bug is fixed these lines would fail, so fix this up before. Signed-off-by: Florian Westphal <fw@strlen.de>
* netlink_delinearize: kill dependency before eval of 'redirect' stmtFlorian Westphal2018-04-011-1/+3
| | | | | | | | | | | | | ip protocol 6 redirect to :tcp dport map { 22 : 8000, 80 : 8080} is printed as redirect to :tcp dport map { 22 : 8000, 80 : 8080} but that input yields: Error: transport protocol mapping is only valid after transport protocol match so kill dependencies beforehand so nft won't remove it. Signed-off-by: Florian Westphal <fw@strlen.de>
* statement: print space before "{" in set addFlorian Westphal2018-04-011-1/+1
| | | | | | | | | old: add @set5{ ip6 saddr . ip6 daddr} new: add @set5 { ip6 saddr . ip6 daddr} Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Updates for mini-gmp.{c,h}Harsha Sharma2018-03-312-199/+245
| | | | | | | updates from latest stable release of libgmp to get in sync with them Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "payload: don't remove icmp family dependency in special cases"Florian Westphal2018-03-281-9/+0
| | | | | | | | This reverts commit 126706c23c0458b07d54550dc27561b30f8a43f2. As its now ok to use icmp-in-ip6 family we can remove the dependency. Signed-off-by: Florian Westphal <fw@strlen.de>
* proto: permit icmp-in-ipv6 and icmpv6-in-ipv4Florian Westphal2018-03-285-7/+49
| | | | | | | | | | | | | | | | | Jozsef points out that meta l4proto icmp icmp type destination-unreachable is hard to read. So, lets just add icmp/icmpv6 to ip/ip6 protocol base so users can just go with icmp type destination-unreachable and let nft fill in needed dependency. After this patch, the recent patch to not remove the dependency can be reverted again. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* payload: don't remove icmp family dependency in special casesFlorian Westphal2018-03-271-0/+9
| | | | | | | | | | | | | | | | | | | | | | | When using nftables to filter icmp-in-ipv6 or icmpv6-in-ipv4 we erronously removed the dependency, i.e. "lis ruleset" shows table ip6 filter { chain output { type filter hook output priority 0; policy accept; icmp type destination-unreachable } } but that won't restore because of ip vs ipv6 conflict. After this patch, this lists as meta l4proto icmp icmp type destination-unreachable instead. We still remove the dependency in "ip" family. Same applies to icmpv6-in-ip. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: meta: icmp, icmpv6: don't kill required dependenciesFlorian Westphal2018-03-275-8/+48
| | | | | | | | when explicitly filtering icmp-in-ipv6 and icmp6-in-ip don't remove the required l3 protocol dependency, else "nft list ruleset" can't be read via nft -f anymore. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: avoid errouneous assert with map+concatFlorian Westphal2018-03-271-0/+8
| | | | | | | | | | | | | | | | | | Phil reported following assert: add rule ip6 f o mark set ip6 saddr . ip6 daddr . tcp dport \ map { dead::beef . f00::. 22 : 1 } nft: netlink_linearize.c:655: netlink_gen_expr: Assertion `dreg < ctx->reg_low' failed. This happens because "mark set" will allocate one register (the dreg), but netlink_gen_concat_expr will populate a lot more register space if the concat expression strings a lot of expressions together. As the assert is useful pseudo-reserve the register space as per concat->len and undo after generating the expressions. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: nft.8 more spelling fixesDuncan Roe2018-03-272-27/+244
| | | | | | | | | | | | | | | | | | | | | | | | I ran the following command: ispell -p ./ispell_nft -H nft.xml to create the local dictionary ispell_nft. ispell_nft contains almost every special word in nft.xml. The idea is that anyone can run ispell the same way and only have to accept: - alpha strings in hexadecimal numbers - "FIXME" : that has to be fixed eventually - "differv" : I don't know what that is or whether it's correct You need to use the English (i.e. American) dictionary, and you want the screen to be about 100 chars wide (at least). The patch enforces consistent capitalisation of words, e.g. IPv4 is always that way but ipv4_addr stays as before. The existing dictionary suggested capital Ethernet so that is in there too. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* remove todo listFlorian Westphal2018-03-261-25/+0
| | | | | | its outdated. Signed-off-by: Florian Westphal <fw@strlen.de>
* Export libnftables (again)Phil Sutter2018-03-215-3/+21
| | | | | | | | | | | | | | This reverts commits d572d59788143945c2a638f12a5227d9b21ce489 and 9f5e49e147219cd161de8cd80cadf8a444969ef0. Current libnftables API should be stable enough to release it into the public, and after 4aba100e593f ("rule: reset cache iff there is an existing cache") we have a simple way to batch commands through this API. Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Test flush and nat chain recreate in one goPhil Sutter2018-03-211-0/+17
| | | | | | | | This tests what kernel commit ae6153b50f9bf ("netfilter: nf_tables: permit second nat hook if colliding hook is going away") fixed for. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests/shell: Allow to specify multiple testcasesPhil Sutter2018-03-201-4/+6
| | | | | | | | | | | Extend run-tests.sh a bit so that all remaining arguments after option parsing are treated as filenames to test and complain if one doesn't seem like such. This allows for doing stuff like: | ./run-tests.sh testcases/include/000* Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix sporadic fail of include/0007glob_double_0Phil Sutter2018-03-202-21/+9
| | | | | | | | | | | | Since ruleset listing shows tables sorted by handle (which in turn depends on table creation ordering), using random filenames here guarantees to make the test fail randomly. Since the include files reside in a temporary directory anyway, there is no need to randomize their names so simplify the whole test a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* flowtable: Make parsing a little more robustPhil Sutter2018-03-203-1/+21
| | | | | | | | | | It was surprisingly easy to crash nft with invalid syntax in 'add flowtable' command. Catch at least three possible ways (illustrated in provided test case) by making evaluation phase survive so that bison gets a chance to complain. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix flowtable test casesPhil Sutter2018-03-207-14/+14
| | | | | | | | | | | | | The major problem here was that existence of network interfaces 'eth0' and 'wlan0' was assumed. Overcome this by just using 'lo' instead, which exists even in newly created netns by default. Another minor issue was false naming of 0004delete_after_add0 - the expected return code is supposed to be separated by '_' from the remaining filename. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Fix dump of chains/0016delete_handle_0Phil Sutter2018-03-201-6/+0
| | | | | | | | | The purpose of this test is to delete some chains by their handle and that is supposed to succeed. So the respective dump should not contain them anymore. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Support 'nft -f -' to read from stdinPhil Sutter2018-03-2059-620/+116
| | | | | | | | | | | | | | | | | | In libnftables, detect if given filename is '-' and treat it as the common way of requesting to read from stdin, then open /dev/stdin instead. (Calling 'nft -f /dev/stdin' worked before as well, but this makes it official.) With this in place and bash's support for here strings, review all tests in tests/shell for needless use of temp files. Note that two categories of test cases were intentionally left unchanged: - Tests creating potentially large rulesets to avoid running into shell parameter length limits. - Tests for 'include' directive for obvious reasons. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: reset cache iff there is an existing cachePablo Neira Ayuso2018-03-191-1/+3
| | | | | | | | | | | | | | If genid is unset, then do not reset existing cache. In the kernel, generation ID is assumed to be always != zero. This patch fixes: nft 'add table x; add chain x y;' that allow us to send several commands in one single batch from the command line. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft.8 aim for consistent synopses throughout (again)Duncan Roe2018-03-191-15/+7
| | | | | | | | | Fix a few more items as per commit f9cb9580b924f6320005f429f7d59e52a38aff82 Also insert a missing space I noticed along the way Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: describe table dormant flagFlorian Westphal2018-03-171-1/+62
| | | | | | | | also mention how to quit interactive mode and provide small table add example. Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Combine redir and masq statements into natPhil Sutter2018-03-176-262/+89
| | | | | | | | | | | | | | | | | | | All these statements are very similar, handling them with the same code is obvious. The only thing required here is a custom extension of enum nft_nat_types which is used in nat_stmt to distinguish between snat and dnat already. Though since enum nft_nat_types is part of kernel uAPI, create a local extended version containing the additional fields. Note that nat statement printing got a bit more complicated to get the number of spaces right for every possible combination of attributes. Note also that there wasn't a case for STMT_MASQ in rule_parse_postprocess(), which seems like a bug. Since STMT_MASQ became just a variant of STMT_NAT, postprocessing will take place for it now anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: evaluate: add preliminary binop transfer support for vmapsFlorian Westphal2018-03-171-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | nftables doesn't support vmap with bit-sized headers, such as flow label or dscp: nft add rule ip filter input ip dscp vmap \{ 4 : accept, 63 : continue \} BUG: invalid binary operation 5 Unlike plain "ip dscp { 4, 63 }", we don't have a relational operation in case of vmap. Binop fixups need to be done when evaluating map statements. This patch is incomplete. 'ip dscp' works, but this won't: nft add rule --debug=netlink ip6 test-ip6 input ip6 dscp vmap { 0x04 : accept, 0x3f : continue } The generated expressions look sane, however there is disagreement on the sets key size vs. the sizes of the individual elements in the set. This is because ip6 dscp spans a byte boundary. Key set size is still set to one byte (dscp type is 6bits). However, binop expansion requirements result in 2 byte loads, i.e. set members will be 2 bytes in size as well. This can hopefully get addressed in an incremental patch. Signed-off-by: Florian Westphal <fw@strlen.de>
* evaluate: handle binop adjustment recursivelyFlorian Westphal2018-03-171-21/+32
| | | | | | | | | | | | | | | currently this is fine, but a followup commit will add EXPR_SET_ELEM handling. And unlike RANGE we cannot assume the key is a value. Therefore make binop_can_transfer and binop_transfer_one handle right hand recursively if needed. For RANGE, call it again with from/to. For future SET_ELEM, we can then just call the function recursively again with right->key as new RHS. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: segtree: use value expression lengthFlorian Westphal2018-03-171-1/+1
| | | | | | | | | | In case of EXPR_MAPPING, expr->len is 0, we need to use the length of the key instead. Without this we can get assertion failure later on: nft: netlink_delinearize.c:1484: binop_adjust_one: Assertion `value->len >= binop->right->len' failed. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: netlink_delinearize: don't assume element contains a valueFlorian Westphal2018-03-171-1/+1
| | | | | | | | | | | We cannot assume i->key->key is EXPR_VALUE, we could look e.g. at a range, which will trigger an assertion failure in binop_adjust_one(). We should call __binop_adjust recursively again in the EXPR_SET_ELEM case, using key as new input. Fixes: b8b8e7b6ae10 ("evaluate: transfer right shifts to set reference side") Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add test cases for vmap binop transferFlorian Westphal2018-03-178-0/+138
| | | | | | they fail with 'BUG: invalid binary operation 5'. Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: add srh test casesFlorian Westphal2018-03-172-0/+86
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: fix routing header supportFlorian Westphal2018-03-173-25/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We can't use nft_exthdr_op to encode routing header, it breaks ipv6 extension header support. When encountering RT header, userspace did now set a new ipv6 exthdr mode, but old kernel doesn't know about this, so this failed with -EOPNOTSUPP. Revert that part and use NFT_EXTHDR_OP_IPV6. When decoding a routing extension header, try the various route types until we find a match. Note this patch isn't complete: 'srh tag 127' creates following expressions: [ exthdr load 2b @ 43 + 6 => reg 1 ] [ cmp eq reg 1 0x00007f00 ] It should instead insert a dependency test ("rt type 4"): [ exthdr load 1b @ 43 + 2 => reg 1 ] [ cmp eq reg 1 0x00000004 ] [ exthdr load 2b @ 43 + 6 => reg 1 ] [ cmp eq reg 1 0x00007e00 ] nft should then use this to infer the routing header type. While add it, document the srh option. Fixes: 1400288f6d39d ("src: handle rt0 and rt2 properly") Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Ahmed Abdelsalam <amsalam20@gmail.com>
* tests: update to new syntax to add/update set from packet pathPablo Neira Ayuso2018-03-169-11/+11
| | | | | Reported-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: revisit syntax to update sets and maps from packet pathPablo Neira Ayuso2018-03-163-12/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For sets, we allow this: nft add rule x y ip protocol tcp update @y { ip saddr} For maps: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; update @persistencia \ { @nh,96,32 : numgen inc mod 2 offset 100 } } } nft --debug=netlink add rule ip nftlb pre add @persistencia \ { ip saddr : numgen inc mod 2 offset 100 } More compact and it doesn't gets it confused with a simple map update command (interesting that bison didn't spew any conflict error). Former syntax for sets is preserved. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Fold netlink_gen_cmp() into netlink_gen_relational()Phil Sutter2018-03-161-65/+53
| | | | | | | | | Since netlink_gen_relational() didn't do much anymore after meta OP treating had been removed, it makes sense to merge it with the only function it dispached to. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* relational: Eliminate meta OPsPhil Sutter2018-03-167-131/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With a bit of code reorganization, relational meta OPs OP_RANGE, OP_FLAGCMP and OP_LOOKUP become unused and can be removed. The only meta OP left is OP_IMPLICIT which is usually treated as alias to OP_EQ. Though it needs to stay in place for one reason: When matching against a bitmask (e.g. TCP flags or conntrack states), it has a different meaning: | nft --debug=netlink add rule ip t c tcp flags syn | ip t c | [ meta load l4proto => reg 1 ] | [ cmp eq reg 1 0x00000006 ] | [ payload load 1b @ transport header + 13 => reg 1 ] | [ bitwise reg 1 = (reg=1 & 0x00000002 ) ^ 0x00000000 ] | [ cmp neq reg 1 0x00000000 ] | nft --debug=netlink add rule ip t c tcp flags == syn | ip t c | [ meta load l4proto => reg 1 ] | [ cmp eq reg 1 0x00000006 ] | [ payload load 1b @ transport header + 13 => reg 1 ] | [ cmp eq reg 1 0x00000002 ] OP_IMPLICIT creates a match which just checks the given flag is present, while OP_EQ creates a match which ensures the given flag and no other is present. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests/shell: Use custom nft binary for ruleset listingPhil Sutter2018-03-161-1/+1
| | | | | | | | Don't assume the system's nft binary is able to correctly list rulesets generated in tests. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Revert "src: update dynamic set updates from packet path syntax"Pablo Neira Ayuso2018-03-162-9/+2
| | | | | This reverts commit 9047cc7ae746b1c9abd4e11ed476e37d8716d400, this is breaking tests.
* src: update dynamic set updates from packet path syntaxPablo Neira Ayuso2018-03-152-2/+9
| | | | | | | | | | | | | | | | | | | New prefered syntax is: {add,update} set { key } @name # nft list ruleset table ip x { set y { type ipv4_addr } chain y { ip protocol tcp add set { ip saddr} @y } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: support of dynamic map addition and update of elementsLaura Garcia Liebana2018-03-156-2/+102
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The support of dynamic adds and updates are only available for sets and meters. This patch gives such abilities to maps as well. This patch is useful in cases where dynamic population of maps are required, for example, to maintain a persistence during some period of time. Example: table ip nftlb { map persistencia { type ipv4_addr : mark timeout 1h elements = { 192.168.1.132 expires 59m55s : 0x00000064, 192.168.56.101 expires 59m24s : 0x00000065 } } chain pre { type nat hook prerouting priority 0; policy accept; map update \ { @nh,96,32 : numgen inc mod 2 offset 100 } @persistencia } } An example of the netlink generated sequence: nft --debug=netlink add rule ip nftlb pre map add \ { ip saddr : numgen inc mod 2 offset 100 } @persistencia ip nftlb pre [ payload load 4b @ network header + 12 => reg 1 ] [ numgen reg 2 = inc mod 2 offset 100 ] [ dynset add reg_key 1 set persistencia sreg_data 2 ] Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: use nftnl_flowtable_get/setFlorian Westphal2018-03-121-4/+4
| | | | | | | the '_array' variant is just a wrapper for get/set api; this allows the array variant to be removed from libnftnl. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: Adding support for segment routing header 'srh'Ahmed Abdelsalam2018-03-115-3/+71
| | | | | | | | | | | | | | Segment Routing Header "SRH" is new type of IPv6 Routing extension header (type 4). SRH contains a list of segments (each is represented as an IPv6 address) to be visited by packets during the journey from source to destination. The SRH specification are defined in the below IETF SRH draft. https://tools.ietf.org/html/draft-ietf-6man-segment-routing-header-07 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: handle rt0 and rt2 properlyAhmed Abdelsalam2018-03-113-1/+26
| | | | | | | | | | | | | | | | | | | | | | | Type 0 and 2 of the IPv6 Routing extension header are not handled properly by exthdr_init_raw() in src/exthdr.c In order to fix the bug, we extended the "enum nft_exthdr_op" to differentiate between rt, rt0, and rt2. This patch should fix the bug. We tested the patch against the same configuration reported in the bug and the output is as shown below. table ip6 filter { chain input { type filter hook input priority 0; policy accept; rt0 addr[1] a::2 } } Fixes: Bugzilla #1219 Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add set information and example for run-time blackholeFlorian Westphal2018-03-111-2/+79
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: shell: fix tests for deletion via handle attributeHarsha Sharma2018-03-093-31/+40
| | | | | | | | Fetch object, chain and set handles and with '-a' option and then delete them. Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* rule: print handle attribute in more clearer mannerHarsha Sharma2018-03-091-31/+32
| | | | | | | | | | | Print handles in this way: table ip filter { # handle 2 } Similarly, for chain, set and object handles Signed-off-by: Harsha Sharma <harshasharmaiitr@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* tests: shell: autogenerate dump verificationLaura Garcia Liebana2018-03-09125-565/+711
| | | | | | | | | | | | | | | | | | | | Complete the automated shell tests with the verification of the test file dump, only for positive tests and if the test execution was successful. It's able to generate the dump file with the -g option. Example: # ./run-tests.sh -g testcases/chains/0001jumps_0 The dump files are generated in the same path in the folder named dumps/ with .nft extension. It has been avoided the dump verification code in every test file. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: don't not dump set content from netlink_get_setelems()Pablo Neira Ayuso2018-03-071-1/+0
| | | | | | | This causes python tests to report payload mismatching errors. Fixes: a43cc8d53096 ("src: support for get element command") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: remove unused batch support checksPablo Neira Ayuso2018-03-075-79/+0
| | | | | | Follow up after cc8c5fd02448 ("netlink: remove non-batching routine"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: move monitor code to src/monitor.cPablo Neira Ayuso2018-03-074-919/+975
| | | | | | | | netlink.c is rather large file, move the monitor code to its own file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Acked-by: Phil Sutter <phil@nwl.cc> Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* src: support for get element commandPablo Neira Ayuso2018-03-0711-7/+326
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | You need a Linux kernel >= 4.15 to use this feature. This patch allows us to dump the content of an existing set. # nft list ruleset table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 3.3.3.3, 5.5.5.5-6.6.6.6 } } } You check if a single element exists in the set: # nft get element x x { 1.1.1.5 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } Output means '1.1.1.5' belongs to the '1.1.1.1-2.2.2.2' interval. You can also check for intervals: # nft get element x x { 1.1.1.1-2.2.2.2 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2 } } } If you try to check for an element that doesn't exist, an error is displayed. # nft get element x x { 1.1.1.0 } Error: Could not receive set elements: No such file or directory get element x x { 1.1.1.0 } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ You can also check for multiple elements in one go: # nft get element x x { 1.1.1.5, 5.5.5.10 } table ip x { set x { type ipv4_addr flags interval elements = { 1.1.1.1-2.2.2.2, 5.5.5.5-6.6.6.6 } } } You can also use this to fetch the existing timeout for specific elements, in case you have a set with timeouts in place: # nft get element w z { 2.2.2.2 } table ip w { set z { type ipv4_addr timeout 30s elements = { 2.2.2.2 expires 17s } } } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: bump libnftnl dependencyPablo Neira Ayuso2018-03-061-1/+1
| | | | | | Check for 1.1.0, which includes flowtable symbols. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 14:19:52 +0000