* Mask as part of element in set
@ 2024-03-27 8:36 Vlad Tsisyk
2024-03-27 9:16 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Vlad Tsisyk @ 2024-03-27 8:36 UTC (permalink / raw)
To: netfilter
Hello,
I have a set of pairs of MAC address and mask:
aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff
aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
...
I want to apply a mask to source MAC from the packet, and then compare
the result with the MAC from the pair. I can do it like so:
nft add table t
nft add chain t c
nft --debug=netlink add rule ip t c ether saddr and aa:bb:cc:dd:ee:ff
00:ff:ff:ff:ff:00
ip t c
[ meta load iiftype => reg 1 ]
[ cmp eq reg 1 0x00000001 ]
[ payload load 6b @ link header + 6 => reg 1 ]
[ bitwise reg 1 = (reg=1 & 0xddccbbaa 0x0000ffee ) ^ 0x00000000
0x00000000 ]
[ cmp eq reg 1 0xffffff00 0x000000ff ]
...
But I have to create a new rule for each pair. Is there any
workarounds to use sets?
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Mask as part of element in set
2024-03-27 8:36 Mask as part of element in set Vlad Tsisyk
@ 2024-03-27 9:16 ` Pablo Neira Ayuso
2024-03-28 8:20 ` Vlad Tsisyk
0 siblings, 1 reply; 3+ messages in thread
From: Pablo Neira Ayuso @ 2024-03-27 9:16 UTC (permalink / raw)
To: Vlad Tsisyk; +Cc: netfilter
On Wed, Mar 27, 2024 at 03:36:19PM +0700, Vlad Tsisyk wrote:
> Hello,
>
> I have a set of pairs of MAC address and mask:
>
> aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff
You would like to match this?
xx:bb:cc:dd:ee:ff
or mark is reversed?
> aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
>
> ...
>
> I want to apply a mask to source MAC from the packet, and then compare
> the result with the MAC from the pair. I can do it like so:
>
> nft add table t
> nft add chain t c
> nft --debug=netlink add rule ip t c ether saddr and aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:00
because rule syntax is not correct, mask is reversed:
nft --debug=netlink add rule ip t c ether saddr and 00:ff:ff:ff:ff:00 == aa:bb:cc:dd:ee:ff
that is:
nft --debug=netlink add rule ip t c ether saddr and MASK == VALUE
> ip t c
> [ meta load iiftype => reg 1 ]
> [ cmp eq reg 1 0x00000001 ]
> [ payload load 6b @ link header + 6 => reg 1 ]
> [ bitwise reg 1 = (reg=1 & 0xddccbbaa 0x0000ffee ) ^ 0x00000000
> 0x00000000 ]
> [ cmp eq reg 1 0xffffff00 0x000000ff ]
> ...
>
> But I have to create a new rule for each pair. Is there any
> workarounds to use sets?
You can use ranges in sets.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Mask as part of element in set
2024-03-27 9:16 ` Pablo Neira Ayuso
@ 2024-03-28 8:20 ` Vlad Tsisyk
0 siblings, 0 replies; 3+ messages in thread
From: Vlad Tsisyk @ 2024-03-28 8:20 UTC (permalink / raw)
To: netfilter
Thank you for your answer!
ср, 27 мар. 2024 г. в 16:16, Pablo Neira Ayuso <pablo@netfilter.org>:
>
> On Wed, Mar 27, 2024 at 03:36:19PM +0700, Vlad Tsisyk wrote:
> > I have a set of pairs of MAC address and mask:
> >
> > aa:bb:cc:dd:ee:ff 00:ff:ff:ff:ff:ff
>
> You would like to match this?
>
> xx:bb:cc:dd:ee:ff
Yes, I want to match those addresses, where the first byte can be anything.
> that is:
>
> nft --debug=netlink add rule ip t c ether saddr and MASK == VALUE
Sorry for my mistake. I swapped MASK and VALUE for no reason.
> > But I have to create a new rule for each pair. Is there any
> > workarounds to use sets?
>
> You can use ranges in sets.
I was thinking about ranges, but ranges will not allow match over LSBs
of MAC ignoring MSBs.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-03-28 8:20 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-03-27 8:36 Mask as part of element in set Vlad Tsisyk
2024-03-27 9:16 ` Pablo Neira Ayuso
2024-03-28 8:20 ` Vlad Tsisyk
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).