On Tue, May 31, 2016 at 12:08:57AM +0200, Arturo Borrero Gonzalez wrote: > On 30 May 2016 at 21:47, Laura Garcia Liebana <nevola@xxxxxxxxx> wrote: > > Add translation for multiport to nftables, which it's supported natively. > > > > Examples: > > > > $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80,81 -j ACCEPT > > nft add rule ip filter INPUT ip protocol tcp tcp dport { 80,81} counter accept > > > > $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport --dports 80:88 -j ACCEPT > > nft add rule ip filter INPUT ip protocol tcp tcp dport { 80-88} counter accept > > > > $ sudo iptables-translate -t filter -A INPUT -p tcp -m multiport ! --dports 80:88 -j ACCEPT > > nft add rule ip filter INPUT ip protocol tcp tcp dport != 80-88 counter accept > > > > Lets clarify the syntax, this is valid: > > tcp dport 8000-8100 > tcp dport { 8000-8100} > tcp dport { 8000-8100, 9000-9100} > > but they mean different things. It seems we should avoid the braces {} > for the range case, otherwise we would be using a set with a single > element. > > However, > > tcp dport {8000,8100} <-- valid > tcp dport 8000,8100 <-- invalid > > So we should always use braces {} in the non-range case. > > Same seems to apply in the case of inversion. > > so we end with this combinations: > > tcp dport {x,x} > tcp dport != {x,x} > tcp dport x-x > tcp dport != x-x > > BTW, related to this, there seems to be a bug in nftables: > > % nft add rule t c tcp dport != {80, 81} > BUG: invalid expression type set > nft: evaluate.c:1463: expr_evaluate_relational: Assertion `0' failed. > Aborted This is not yet supported. This requires a small kernel patch to allow inversions in the nft_lookup.c. Then, the little extra code for libnftnl and nft. All tests for this usecase are disabled at the moment. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html