On Sat, 14 Oct 2023, U.Mutlu wrote: > Jozsef Kadlecsik wrote on 10/13/23 21:05: > > On Fri, 13 Oct 2023, U.Mutlu wrote: > > > > > 1) Which libipset function can be used for getting > > > the packet counter value of a single entry in the set/list? > > > > > > Using the function ipset_parse_line(ips, line) I can issue most of the > > > ipset functions, but I need also a method for getting the packet counter > > > for just a single item only, ie. not the output of all items as "ipset > > > save" does. I need to do this in C/C++ (hence libipset in Linux), ie. > > > not in script. > > > > There is no such functionality in ipset. You can test the existence of an > > element in a set or list/save all of them with all of the attached > > attributes. > > I guess you mean just the ipset command line tool, whereas I explicitly > stated libipset. No, the functionality is missing both from the kernel and the user parts. Have a look at the ip_set_utest() function in the kernel which answers the test requests: just an error/success code is returned to userspace and nothing else. While the dump function (for save/restore) works for whole sets only. There is no "get_element" like functionality. > After researching it further I think it should be possible to read the > counter of a single item via libipset & co., or at least testing the > item for having a counter value "gt" etc, as is already possible in the > iptables extensions, ie. "-m set --packets-gt value" etc. That is for the kernel match functions to find matching elements in the sets with given criteria. > > > 2) man ipset says > > > "test SETNAME TEST-ENTRY [ TEST-OPTIONS ] > > > Test whether an entry is in a set or not. Exit status number is zero > > > if the > > > tested entry is in the set and nonzero if it is missing from the set." > > > > > > But the TEST-OPTIONS are not further described or documented. > > > What test options are possible? > > > > There's a single one in the case of list:set: to test the element before > > or after a reference one. > > Can you give a practical example for this? I can give you an example but I don't think it's practical. # Create a few sets ipset n hosts hash:ip ipset n nets hash:net ipset n hostswithports hash:ip,port ipset n netswithports hash:net,port # "Aggregate" them in one single set so that you can refer them # in a singe ip[6]tables rule ipset n access list:set ipset a access netswithports ipset a access hostswithports ipset a access nets ipset a access hosts # If you want to make sure the order is right in the "access" set # ... but listing is more straightforward ipset t access nets before hosts # returns ture ipset t access nets before hostswithports # returns false Best regards, Jozsef -- E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics H-1525 Budapest 114, POB. 49, Hungary
