[Resent because, I think, I screwed up gmane+gnus and sent it only to myself.]
--- Begin Message ---
- Subject: Re: ct state vmap (nft noob question)
- From: trentbuck@xxxxxxxxx (Trent W. Buck)
- Date: Wed, 24 Jul 2019 19:53:13 +1000
- In-reply-to: <87tvbd3yiw.fsf@goll.lan> (Trent W. Buck's message of "Tue, 23 Jul 2019 19:12:23 +1000")
- References: <87tvbd3yiw.fsf@goll.lan>
- User-agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
trentbuck@xxxxxxxxx (Trent W. Buck) writes:
> ct state vmap { established:accept, related:accept, invalid:drop }
This works.
> ct state vmap { established or related: accept, invalid: drop }
This doesn't. Why?
In the attached output, you can see that "established,related" becomes
0x6 (bitwise xor of the two constants 0x2 and 0x4) in all rules.
It looks to me like "ct state 0x1234" is implicitly a bitwise-and (&),
whereas "ct state vmap { 0x1234: accept }" is implicitly an equals (==).
So the former matches when ct state has ANY bits matching 0x1234;
but the latter matches when ct state has ALL bits matching 0x1234.
Have I understood that right?
root@not-omega:~# cat tmp3.nft
flush ruleset
table inet x {
chain y {
type filter hook input priority filter
policy accept
counter
ct state { established, related } counter
ct state established,related counter
counter comment "This counter should be bigger than the next one!"
ct state vmap { established or related: accept, invalid: drop }
counter comment "This counter should be less than the previous one!"
ct state vmap { established: accept, related: accept, invalid: drop }
counter comment "This counter should be the same as the previous one!"
}
}
list ruleset
root@not-omega:~# nft --file tmp3.nft
table inet x {
chain y {
type filter hook input priority filter; policy accept;
counter packets 0 bytes 0
ct state { established, related } counter packets 0 bytes 0
ct state 0x6 counter packets 0 bytes 0
counter packets 0 bytes 0 comment "This counter should be bigger than the next one!"
ct state vmap { 0x6 : accept, invalid : drop }
counter packets 0 bytes 0 comment "This counter should be less than the previous one!"
ct state vmap { established : accept, related : accept, invalid : drop }
counter packets 0 bytes 0 comment "This counter should be the same as the previous one!"
}
}
root@not-omega:~# ping -c1 localhost
[...]
root@not-omega:~# nft list ruleset
table inet x {
chain y {
type filter hook input priority filter; policy accept;
counter packets 31 bytes 2404
ct state { established, related } counter packets 30 bytes 2320
ct state established,related counter packets 30 bytes 2320
counter packets 31 bytes 2404 comment "This counter should be bigger than the next one!"
ct state vmap { invalid : drop, established | related : accept }
counter packets 31 bytes 2404 comment "This counter should be less than the previous one!"
ct state vmap { invalid : drop, established : accept, related : accept }
counter packets 1 bytes 84 comment "This counter should be the same as the previous one!"
}
}
root@not-omega:~#
--- End Message ---