How to determine type of nftables set

Ian Pilcher <[email protected]> Mon, 8 Dec 2025 17:32:27 -0600
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <[email protected]>
I am working on an application that will be working with pre-existing
(created by the system administrator) netfilter sets.  These sets should
contain either IPv4 of IPv6 addresses.

How can my application determine what type of address a particular set
holds?  I can query the set and get a NFT_MSG_GETSET message back, but
it's murky after that.

The message contains a NFTA_SET_KEY_TYPE attribute, which looks
promising, but I can't find anything telling me how to interpret it.
ChatGPT says that I should just look at the NFTA_SET_KEY_LEN attribute,
but that doesn't seem reliable; how would I distinguish a 32-bit IPv4
address from 2 16-bit ports?

Short of digging through the source code of nft, how am I supposed to do
this?

TIA!

-- 
========================================================================
If your user interface is intuitive in retrospect ... it isn't intuitive
========================================================================