How to determine type of nftables set
Ian Pilcher <[email protected]> Mon, 8 Dec 2025 17:32:27 -0600
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
I am working on an application that will be working with pre-existing (created by the system administrator) netfilter sets. These sets should contain either IPv4 of IPv6 addresses. How can my application determine what type of address a particular set holds? I can query the set and get a NFT_MSG_GETSET message back, but it's murky after that. The message contains a NFTA_SET_KEY_TYPE attribute, which looks promising, but I can't find anything telling me how to interpret it. ChatGPT says that I should just look at the NFTA_SET_KEY_LEN attribute, but that doesn't seem reliable; how would I distinguish a 32-bit IPv4 address from 2 16-bit ports? Short of digging through the source code of nft, how am I supposed to do this? TIA! -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================