Lookup support in a set ?

[sontumzmdr]

Nftable cmd supports lookup of elements within a set given the inputs, it supports CIDR, range.

root [ /home/user ]# nft get element inet filter_table SET_IP6_netRuleCollection_Allow_0 { tcp . 10:0:1::10 . 11:0:1::10 . 8003}
table inet filter_table {
set SET_IP6_netRuleCollection_Allow_0 {
type inet_proto . ipv6_addr . ipv6_addr . inet_service
flags interval
elements = { tcp . 10:0:1::10 . ::/0 . 8003 }
}
}
root [ /home/user ]#

Does this nftable go package support this?
I see below code for GetSetElements but in the Data field it is passed as empty, so I guess currently it will list all the elements.
Is there a plan to support it in future? I would assume it will be trivial to add lookup element in the Data field?

func (cc *Conn) GetSetElements(s *Set) ([]SetElement, error) {
conn, closer, err := cc.netlinkConn()
if err != nil {
return nil, err
}
defer func() { _ = closer() }()

data, err := netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_SET_TABLE, Data: []byte(s.Table.Name + "\x00")},
	{Type: unix.NFTA_SET_NAME, Data: []byte(s.Name + "\x00")},
})
if err != nil {
	return nil, err
}

message := netlink.Message{
	Header: netlink.Header{
		Type:  netlink.HeaderType((unix.NFNL_SUBSYS_NFTABLES << 8) | unix.NFT_MSG_GETSETELEM),
		Flags: netlink.Request | netlink.Acknowledge | netlink.Dump,
	},
	Data: append(extraHeader(uint8(s.Table.Family), 0), data...),
}`

[stapelberg]

cc @turekt as our expert on sets

Does this nftable go package support this?

It might be easier to just try it out and see if it works, instead of waiting for someone who happens to know and could confirm… :)

Is there a plan to support it in future?

There are no proactive development plans for this project. It does what I need it to do. If anyone else needs more features, they are welcome to contribute the features they need.

[turekt]

TL;DR As far as I see, this is currently not supported. The quickest way to perform a lookup would be to call conn.GetSetElements(set) and then iterate the list until the value is matched.

Long answer

My observations for now, using the simplest example:

nft add table ip filter
nft add set ip filter saddrs {type ipv4_addr . inet_proto \; elements={1.1.1.1 . tcp, 192.168.1.1 . udp, 192.168.1.2 . tcp} \;}

The resulting mnl for nft --debug=mnl get element ip filter saddrs { 1.1.1.1 . tcp, 192.168.1.1 . udp } is:

----------------	------------------
|  0000000088  |	| message length |
| 02573 | R-A- |	|  type | flags  |
|  0000000001  |	| sequence number|
|  0000000000  |	|     port ID    |
----------------	------------------
| 02 00 00 00  |	|  extra header  |
|00011|--|00002|	|len |flags| type|
| 73 61 64 64  |	|      data      |	 s a d d
| 72 73 00 00  |	|      data      |	 r s    
|00011|--|00001|	|len |flags| type|
| 66 69 6c 74  |	|      data      |	 f i l t
| 65 72 00 b4  |	|      data      |	 e r    
|00044|N-|00003|	|len |flags| type|
|00020|N-|00001|	|len |flags| type|
|00016|N-|00001|	|len |flags| type|
|00012|--|00001|	|len |flags| type|
| 01 01 01 01  |	|      data      |	        
| 06 00 00 00  |	|      data      |	        
|00020|N-|00002|	|len |flags| type|
|00016|N-|00001|	|len |flags| type|
|00012|--|00001|	|len |flags| type|
| c0 a8 01 01  |	|      data      |	        
| 11 00 00 00  |	|      data      |	        
----------------	------------------

In order to supply a { 1.1.1.1 . tcp } "filter" to get element, we would need to craft a nft_set_elem_list_attributes containing:

NFTA_SET_ELEM_LIST_TABLE (NLA_STRING) = "filter"
NFTA_SET_ELEM_LIST_SET (NLA_STRING) = "saddrs"
NFTA_SET_ELEM_LIST_ELEMENTS (NLA_NESTED: nft_set_elem_attributes) =
|   nft_set_elem_attribute on index 1 (NLA_NESTED) =
|     NFTA_SET_ELEM_KEY (NLA_NESTED: nft_data) =
|       NFTA_DATA_VALUE (NLA_BINARY) = 
|           01010101 (1.1.1.1)
|           06000000 (unix.IPPROTO_TCP)
|____________________________________________________|

At the moment GetSetElements(set) does not provide a way to add NFTA_SET_ELEM_LIST_ELEMENTS so a completely new function should be implemented for this specific case. Additionally, the nft_data_types struct is also not provided by the Go lib as an available expression so there is more to the implementation than a simple addition of NFTA_SET_ELEM_LIST_ELEMENTS.

Based on currently available functions and until a new function is implemented, the only way to lookup would be to get all set elements and then iterate to perform a lookup.