metal-stack / nftables-exporter

prometheus exporter for nftables metrics
GNU General Public License v3.0
19 stars 7 forks source link

Can't parse addresses from anonymous set #22

Closed myromeu closed 6 months ago

myromeu commented 6 months ago

When exporter got nft dump like this:

{
  "nftables": [
    {
      "metainfo": {
        "version": "1.0.6",
        "release_name": "Lester Gooch #5",
        "json_schema_version": 1
      }
    },
    {
      "table": {
        "family": "inet",
        "name": "test",
        "handle": 14
      }
    },
    {
      "chain": {
        "family": "inet",
        "table": "test",
        "name": "INGRESS-INPUT",
        "handle": 5,
        "type": "filter",
        "hook": "input",
        "prio": 0,
        "policy": "drop"
      }
    },
    {
      "rule": {
        "family": "inet",
        "table": "test",
        "chain": "INGRESS-INPUT",
        "handle": 10,
        "expr": [
          {
            "match": {
              "op": "==",
              "left": {
                "payload": {
                  "protocol": "ip",
                  "field": "saddr"
                }
              },
              "right": {
                "set": [
                  "8.8.8.8",
                  "10.96.0.10",
                  "21.21.0.242"
                ]
              }
            }
          },
          {
            "counter": {
              "packets": 0,
              "bytes": 0
            }
          },
          {
            "accept": null
          }
        ]
      }
    }
  ]
}

Then it exports source_addresses as "any" from set for rule with handle=10:

nftables_rule_bytes{action="accept",chain="INGRESS-INPUT",comment="empty",destination_addresses="any",destination_ports="any",family="inet",handle="10",input_interfaces="any",output_interfaces="any",source_addresses="any",source_ports="any",table="test"} 0