documentation/explaination on the syntax of the set_elem data arrangement.

Pierre Wielders <[email protected]> Wed, 21 May 2025 18:15:06 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Organization Integraal Automatisering
Message-ID <[email protected]>
Dear reader,


I am currently trying to wrap the libmnl into a C++ wrapper that allows 
to get (starting with that) and set rules. So far I was able (using 
reverse engineering ;-) figure out most of the stuff.

I am a bit stuck now on the set_elem in the set. Is there somewhere 
documentation that describes the syntax here?

What I get from the sets:

Table:  [lxc]
Set:    { "name":"__set1",
           "handle":4,
           "flags":3,
           "key": {
             "type":   ["service"],
             "length": 2
           },
           "userdata":{
             "length":6,
             "data": "00:04:02:00:00:00"
           },
           "elements": [
             { "key": {"type":"value","data":"06:00:01:00:00:35:00:00"} 
},
             { "key": {"type":"value","data":"06:00:01:00:00:43:00:00"} }
           ]
         }

I know that the elements in the set represent are the port number 53 
(0x35) and 67 (0x43) :

"match":{
     "op":"==",
     "left":{
         "payload":{
             "protocol":"udp",
             "field":"dport"
         }
     },
     "right":{
         "set":[ 53, 67 ]
     }
}

What is the other information "06:00:01:00" and "00:00". Is there a 
document describing how to interpret the data or can someone explain or 
is reverse engineering the only option (got a bit hard on this part :-)

BR Pierre