turekt
commented
10 months ago Hi @xlango,
your code does not replicate netlink messages sent by the nft command.
Can you test the following code and let me know if it works?
package main
import (
"github.com/google/nftables"
"github.com/google/nftables/binaryutil"
"github.com/google/nftables/expr"
"golang.org/x/sys/unix"
"net"
)
func main() {
c, err := nftables.New()
if err != nil {
panic(err)
}
c.FlushRuleset()
filter := c.AddTable(&nftables.Table{
Family: nftables.TableFamilyIPv4,
Name: "filter",
})
input := c.AddChain(&nftables.Chain{
Name: "output",
Hooknum: nftables.ChainHookOutput,
Priority: nftables.ChainPriorityFilter,
Table: filter,
Type: nftables.ChainTypeFilter,
})
ipSet := &nftables.Set{
Name: "ipSet",
Table: filter,
Interval: true,
KeyType: nftables.TypeIPAddr,
}
if err := c.AddSet(ipSet, nil); err != nil {
panic(err)
}
if err := c.SetAddElements(ipSet, []nftables.SetElement{
{
Key: []byte{0x00, 0x00, 0x00, 0x00},
IntervalEnd: true,
},
{
Key: []byte(net.ParseIP("10.34.11.179").To4()),
},
{
Key: []byte(net.ParseIP("10.34.11.180").To4()),
IntervalEnd: true,
},
}); err != nil {
panic(err)
}
portSet := &nftables.Set{
Name: "portSet",
Table: filter,
Interval: true,
KeyType: nftables.TypeInetService,
}
if err := c.AddSet(portSet, nil); err != nil {
panic(err)
}
if err := c.SetAddElements(portSet, []nftables.SetElement{
{
Key: []byte{0x00, 0x00},
IntervalEnd: true,
},
{
Key: binaryutil.BigEndian.PutUint16(1234),
},
{
Key: binaryutil.BigEndian.PutUint16(1235),
IntervalEnd: true,
},
}); err != nil {
panic(err)
}
c.AddRule(&nftables.Rule{
Table: filter,
Chain: input,
Exprs: []expr.Any{
&expr.Payload{
DestRegister: 1,
Base: expr.PayloadBaseNetworkHeader,
Offset: 16,
Len: 4,
},
&expr.Lookup{
SourceRegister: 1,
SetName: ipSet.Name,
SetID: ipSet.ID,
},
&expr.Meta{Key: expr.MetaKeyL4PROTO, Register: 1},
&expr.Cmp{
Op: expr.CmpOpEq,
Register: 1,
Data: []byte{unix.IPPROTO_TCP},
},
&expr.Payload{
DestRegister: 1,
Base: expr.PayloadBaseTransportHeader,
Offset: 2,
Len: 2,
},
&expr.Lookup{
SourceRegister: 1,
SetName: portSet.Name,
SetID: portSet.ID,
},
&expr.Counter{},
&expr.Log{},
&expr.Verdict{
Kind: expr.VerdictDrop,
},
},
})
if err := c.Flush(); err != nil {
panic(err)
}
}I hope that this resolves your issue.
realsyy
When i used command lines { nft add table ip filter nft add chain ip filter output { type filter hook output priority 0\; } nft add set filter ipSet { type ipv4_addr \; flags interval\;} nft add element ip filter ipSet {10.34.11.179} nft add set filter portSet { type inet_service \; flags interval\;} nft add element ip filter portSet {1234} nft add rule ip filter output ip daddr @ipSet tcp dport @portSet counter log drop
}
to add a rule related to set, it worked correctly. But when i used nftables-main to add a similar rule, it blocked tcp flow to "127.0.0.1" too. The code is : func main() { c, err := nftables.New() if err != nil { return }
}
log