0

I am using the following nftables config to whitelist machines that can use the router:

table bridge filter {
    set authorized {
        typeof ether saddr
        flags constant
        elements = {
            aa:aa:aa:aa:aa:aa,
            ff:ff:ff:ff:ff:ff
        }
    }

    set authorized2 {
        typeof ether daddr
        flags constant
        elements = {
            aa:aa:aa:aa:aa:aa,
            ff:ff:ff:ff:ff:ff
        }
    }

    chain input {
            type filter hook input priority 0; policy drop;
            ether saddr @authorized accept
            ether daddr @authorized2 accept
    }

}

The 2 sets are identical except for the type.

Is there any way to specify and use only 1 set for both saddr and daddr to avoid repeating the MAC addresses?

1 Answer 1

2

That's simple: typeof ether saddr is the same type as typeof ether daddr as can be checked in the man page for nft(8):

ETHERNET HEADER EXPRESSION

ether {daddr | saddr | type}

Table 37. Ethernet header expression types

Keyword Description Type
daddr Destination MAC address ether_addr
saddr Source MAC address ether_addr
type EtherType ether_type

That means one can define a single set with one of the 3 equivalent ways below, with the same result. The visual distinction didn't exist before nftables 0.9.4 where the new typeof keyword that uses definitions from the 1st column was introduced as an alternative to the type keyword that uses definitions from the 3rd column.

  • the original type keyword (requires to check documentation for the exact type)

    type ether_addr
    
  • or the newer typeof keyword (can more or less reuse the vocabulary from a rule using it)

    • either

      typeof ether saddr
      
    • or

      typeof ether daddr
      

So in the end the ruleset can be written just as:

table bridge filter {
    set authorized {
        typeof ether saddr
        flags constant
        elements = {
            aa:aa:aa:aa:aa:aa,
            ff:ff:ff:ff:ff:ff
        }
    }

    chain input {
            type filter hook input priority 0; policy drop;
            ether saddr @authorized accept
            ether daddr @authorized accept
    }
}

Note: the current ruleset accepts anything from the set or anything to the set. It doesn't match both at the same time. Also, since it's the input hook rather than the forward hook, having to accept the destination MAC address being one own's MAC address looks a bit weird (then of course, when obfuscating, one should not set the 1st's byte multicast bit, it's not valid as source. But if the goal is to match a broadcast destination that's one way to do it).

2
  • So, is the 'typeof ether saddr' then ignored when the rule contains ether daddr @authorized, and the rule is matched against the daddr instead (overriding the set definition)?
    – drumfire
    Commented Jan 10 at 16:47
  • typeof ether saddr <=> typeof ether daddr <=> type ether_addr . There's nothing ignored. The set is searched each time for a match.
    – A.B
    Commented Jan 10 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .