Re: Numen with reference to vmap

["Serguei Bezverkhi (sbezverk)" <sbezverk@cisco.com>]

While trying to add an element to the set, I am getting error:

sudo nft --debug all add element ipv4table no-endpoints-services  { tcp . 192.168.80.104 . 8989 : goto do_reject }

Error: Could not process rule: Invalid argument
add element ipv4table no-endpoints-services { tcp . 192.168.80.104 . 8989 : goto do_reject }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Anything am I doing wrong?
Thank you
Serguei

On 2019-12-19, 11:00 AM, "Serguei Bezverkhi (sbezverk)" <sbezverk@cisco.com> wrote:

    HI Phil,
    
    I built 0.9.3 and now it recognizes "th", but there is I suspect a cosmetic issue in the output in nft cli. See below the command I used:
    sudo nft --debug all add rule ipv4table k8s-filter-services ip protocol . ip daddr . th dport vmap @no-endpoints-services
    
    It looks like correctly generating expressions:
    
    ip ipv4table k8s-filter-services 
      [ payload load 1b @ network header + 9 => reg 1 ]
      [ payload load 4b @ network header + 16 => reg 9 ]
      [ payload load 2b @ transport header + 2 => reg 10 ]
      [ lookup reg 1 set no-endpoints-services dreg 0 ]
    
    But when I run "sudo nft list tables ipv4table" the rule is missing third parameter.
    
    table ip ipv4table {
    	map no-endpoints-services {
    		type inet_proto . ipv4_addr . inet_service : verdict
    	}
    
    	chain k8s-filter-services {
    		ip protocol . ip daddr vmap @no-endpoints-services            < ------------------- Missing " th dport"
    	}
    }
    
    It seems just a cosmetic thing, but eventually would be nice to have it fixed, if it has not been already in the master branch. I am using v0.9.3 branch.
    
    Thank you
    Serguei
    On 2019-12-19, 10:46 AM, "n0-1@orbyte.nwl.cc on behalf of Phil Sutter" <n0-1@orbyte.nwl.cc on behalf of phil@nwl.cc> wrote:
    
        Hi,
        
        On Thu, Dec 19, 2019 at 02:59:01PM +0000, Serguei Bezverkhi (sbezverk) wrote:
        > Not sure why, but even with 0.9.2 "th" expression is not recognized.
        > 
        > error: syntax error, unexpected th
        > add rule ipv4table k8s-filter-services ip protocol . ip daddr . th dport vmap @no-endpoints-services
        >                                                                                                           ^^
        > sbezverk@dev-ubuntu-1:mimic-filter$ sudo nft -version
        > nftables v0.9.2 (Scram)
        > sbezverk@dev-ubuntu-1:mimic-filter$
        > 
        > It seems 0.9.3 is out but still no Debian package. Is it possible it did not make it into 0.9.2?
        
        Not sure what's missing on your end. I checked 0.9.2 tarball, at least
        parser should understand the syntax.
        
        Cheers, Phil