Re: nft named set address types

From: Eugene Crosser <crosser@average.org>
To: Matt Zagrabelny <mzagrabe@d.umn.edu>
Cc: netfilter <netfilter@vger.kernel.org>
Subject: Re: nft named set address types
Date: Mon, 15 Nov 2021 18:59:14 +0100	[thread overview]
Message-ID: <80e0abae-6035-7fe8-f7d7-5eb1983c8f8b@average.org> (raw)
In-Reply-To: <CAOLfK3XJHhm5z6b1MOaMFjK2P2V9jyPgOtSOFZUswPSxuEZLEA@mail.gmail.com>

[-- Attachment #1.1: Type: text/plain, Size: 865 bytes --]

On 15/11/2021 18:40, Matt Zagrabelny wrote:

> I've tried:
> 
> table inet filter {
>     chain icmp_ipv4 {
>         ip  saddr $icmp_networks_ipv4 accept
>     }
> 
>     chain icmp_ipv6 {
>         ip6 saddr $icmp_networks_ipv6 accept
>     }
> 
>     chain input {
>         meta protocol {icmp, icmpv6} vmap {
>             icmp: jump icmp_ipv4,
>             icmpv6: jump icmp_ipv6,
>         }
>     }
> }

This is simply incorrect syntax. You need it like this, I believe:

    <value> `vmap` {map with verdicts}

e.g.

table inet testfilter {

    chain icmp_ipv4 {

        accept

    }

    chain icmp_ipv6 {

        accept

    }

    chain input {

        meta protocol vmap {

            icmp: jump icmp_ipv4,

            icmpv6: jump icmp_ipv6,

        }

    }

}

Regards,

Eugene

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]