Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding jump to vmap error "operation not supported" #187

Open
rampxxxx opened this issue Sep 13, 2022 · 2 comments
Open

Adding jump to vmap error "operation not supported" #187

rampxxxx opened this issue Sep 13, 2022 · 2 comments

Comments

@rampxxxx
Copy link

Hi,

I'm trying to use map to jump to different chains based in daddr but I got error "netlink receive: operation not supported" , this is my sample code https://go.dev/play/p/OKn2-_Dd81S
In nftables_test.go ln:5016 there is a map similar from which I copied how to create the element with no luck.

Also I'm trying to use a rule to do the match and after add IsDestRegSet as in #176 it seems the rule is created ok.

I'm working with versions v0.9.3 and v1.0.5

Thanks in advance!

@turekt
Copy link
Contributor

turekt commented Sep 16, 2022

Hi @rampxxxx,

unfortunately transforming the code into regular nft cmds shows that this won't work:

# nft flush ruleset
# nft add table test_table
# nft add chain test_table test_chain { type filter hook prerouting priority filter \; }
# nft add chain test_table test_chain_jump { type filter hook prerouting priority filter \; }
# nft add map test_table test_map { type ipv4_addr: verdict\; }
# nft add element test_table test_map { 1.1.1.1 : jump test_chain_jump }
Error: Could not process rule: Operation not supported
add element test_table test_map { 1.1.1.1 : jump test_chain_jump }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The thing is that the jump action can be used only on regular chains (see last sentence in https://wiki.nftables.org/wiki-nftables/index.php/Jumping_to_chain). For the definition of regular chains see https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Adding_regular_chains, it is basically a chain that does not have the hook keyword.

# cat nf.sh
#!/bin/bash
nft flush ruleset
nft add table test_table
nft add chain test_table test_chain { type nat hook prerouting priority filter \; }
nft add chain test_table test_chain_jump { }
nft add map test_table test_map { type ipv4_addr: verdict\; }
nft add element test_table test_map { 1.1.1.1 : jump test_chain_jump }
# bash nf.sh
# nft list ruleset
table ip test_table {
	map test_map {
		type ipv4_addr : verdict
		elements = { 1.1.1.1 : jump test_chain_jump }
	}

	chain test_chain {
		type nat hook prerouting priority filter; policy accept;
	}

	chain test_chain_jump {
	}
}

I hope that this resolves your issue.

@rampxxxx
Copy link
Author

Hi @turekt thank you for the response! (sorry for my late response)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants