Verdict Maps (vmaps) - Revision history

Fmyhr: /* Valid vmap Verdicts */ Link nft man page

2021-02-12T10:08:50Z

Valid vmap Verdicts: Link nft man page

← Older revision		Revision as of 10:08, 12 February 2021
Line 73:		Line 73:
	= Valid vmap Verdicts =		= Valid vmap Verdicts =

	The name ''verdict map'' can be taken literally: each element must map to a single simple ''verdict statement''. To recap the ''nft'' man page section, the complete list of such verdict statements is:		The name ''verdict map'' can be taken literally: each element must map to a single simple ''verdict statement''. To recap the [[Further_documentation \| ''nft'' man page]] section, the complete list of such verdict statements is:
	* accept		* accept
	* drop		* drop

Fmyhr: Added section to clarify that each vmap element must map to a simple verdict statement.

2021-02-12T10:06:00Z

Added section to clarify that each vmap element must map to a simple verdict statement.

← Older revision		Revision as of 10:06, 12 February 2021
Line 69:		Line 69:
	<nowiki>% nft describe ip saddr		<nowiki>% nft describe ip saddr
	payload expression, datatype ipv4_addr (IPv4 address) (basetype integer), 32 bits</nowiki>		payload expression, datatype ipv4_addr (IPv4 address) (basetype integer), 32 bits</nowiki>


			= Valid vmap Verdicts =

			The name ''verdict map'' can be taken literally: each element must map to a single simple ''verdict statement''. To recap the ''nft'' man page section, the complete list of such verdict statements is:
			* accept
			* drop
			* queue
			* continue
			* return
			* jump ''chain''
			* goto ''chain''

Fmyhr: Changed refs dictionary -> vmap (while still noting synonym). Renamed sections anonymous & named vmaps. Modified nft describe example to correspond to immediately preceding example.

2021-02-12T09:57:58Z

Changed refs dictionary -> vmap (while still noting synonym). Renamed sections anonymous & named vmaps. Modified nft describe example to correspond to immediately preceding example.

← Older revision		Revision as of 09:57, 12 February 2021
Line 1:		Line 1:
	~~The ''dictionaries'', also known as ''verdict~~ maps'', ~~are one of~~ the ~~most interesting features available in~~ ''~~nftables~~''~~. Basically~~, ~~they~~ allow you to ~~attach an action~~ to ~~an element~~. ~~Dictionaries internally~~ use the [[Sets \| generic set infrastructure]] and therefore share some semantics and options.		Verdict maps, created using the ''vmap'' statement, allow you to map elements directly to verdict statements. Internally they use the [[Sets \| generic set infrastructure]] and therefore share some semantics and options. Some documentation may refer to vmaps as ''dictionaries''.

	= ~~Literal dictionaries~~ =
			= Anonymous vmaps =

	The following example shows how to create a tree of chains that whose traversal depends on the layer 4 protocol type:		The following example shows how to create a tree of chains that whose traversal depends on the layer 4 protocol type:
Line 17:		Line 18:
	</source>		</source>

	You can check that the classification is ~~already~~ happening:		You can check that the classification is happening:

	<source lang="bash">		<source lang="bash">
Line 41:		Line 42:
	</source>		</source>

	~~As you probably already noticed, one of the the good things of nftables~~ is ~~that you can use ''dictionaries'' to construct performance rule-sets. This rule-set arrangement allows you~~ to reduce the ~~amount~~ of linear list inspections to classify your packets.		The branching chain structure illustrated above is a powerful way to reduce the number of linear list inspections needed to classify your packets.

	~~= Dictionary declarations =~~

	You can also ~~declarate dictionaries and populate its content~~ dynamically~~, for~~ example:		= Named vmaps =

			You can also declare named vmaps, which can then be populated dynamically. For example:

	<source lang="bash">		<source lang="bash">
Line 57:		Line 59:
	</source>		</source>

	You can bind this ~~set~~ to a rule using the following command:		You can bind this vmap to a rule using the following command:

	<source lang="bash">		<source lang="bash">
Line 63:		Line 65:
	</source>		</source>

	In case you ~~want~~ to ~~build your own dictionary~~, ~~but you don't know what is the datatype name. Remember~~ that you can ~~inquire~~ ''nft'' ~~to know the datatype name~~:		Note that in the above example we had to specify the correct ipv4_addr [[Data_types \| data type]] when creating the ''mydict'' vmap. In case you are unsure of the correct data type to specify, recall that you can ask ''nft'':

	~~<source lang="bash">~~
	~~% nft describe tcp dport~~
	~~payload expression, datatype inet_service (internet network service) (basetype integer), 16 bits~~
	~~</source>~~

	~~See the ''inet_service'' string after~~ datatype.		<nowiki>% nft describe ip saddr
			payload expression, datatype ipv4_addr (IPv4 address) (basetype integer), 32 bits</nowiki>

Fmyhr: Fmyhr moved page Dictionaries to Verdict Maps (vmaps): clarity / preventing confusion: nft man page refers to these exclusively as vmaps; verdict statements are only valid action

2021-02-12T09:22:11Z

Fmyhr moved page Dictionaries to Verdict Maps (vmaps): clarity / preventing confusion: nft man page refers to these exclusively as vmaps; verdict statements are only valid action

← Older revision		Revision as of 09:22, 12 February 2021
(No difference)

Arturo: link to sets

2020-09-07T11:01:37Z

link to sets

← Older revision		Revision as of 11:01, 7 September 2020
Line 1:		Line 1:
	The ''dictionaries'', also known as ''verdict maps'', are one of the most interesting features available in ''nftables''. Basically, they allow you to attach an action to an element. Dictionaries internally use the generic set infrastructure.		The ''dictionaries'', also known as ''verdict maps'', are one of the most interesting features available in ''nftables''. Basically, they allow you to attach an action to an element. Dictionaries internally use the [[Sets \| generic set infrastructure]] and therefore share some semantics and options.

	= Literal dictionaries =		= Literal dictionaries =

Arturo: /* Literal dictionaries */ drop unrelated example line

2019-11-04T14:06:34Z

Literal dictionaries: drop unrelated example line

← Older revision		Revision as of 14:06, 4 November 2019
Line 7:		Line 7:
	<source lang="bash">		<source lang="bash">
	% nft add rule ip filter input ip protocol vmap { tcp : jump tcp-chain, udp : jump udp-chain , icmp : jump icmp-chain }		% nft add rule ip filter input ip protocol vmap { tcp : jump tcp-chain, udp : jump udp-chain , icmp : jump icmp-chain }
	~~% nft add rule ip filter input counter drop~~
	</source>		</source>

Arturo: /* Dictionary declarations */ typo directionary

2019-07-30T12:20:01Z

Dictionary declarations: typo directionary

← Older revision		Revision as of 12:20, 30 July 2019
Line 64:		Line 64:
	</source>		</source>

	In case you want to build your own ~~directionary~~, but you don't know what is the datatype name. Remember that you can inquire ''nft'' to know the datatype name:		In case you want to build your own dictionary, but you don't know what is the datatype name. Remember that you can inquire ''nft'' to know the datatype name:

	<source lang="bash">		<source lang="bash">

Arturo: /* Literal dictionaries */ typo double 'that'

2019-07-30T12:18:37Z

Literal dictionaries: typo double 'that'

← Older revision		Revision as of 12:18, 30 July 2019
Line 10:		Line 10:
	</source>		</source>

	This example above assumes ~~that~~ that you've already created the ''tcp-chain'', ''udp-chain'' and ''icmp-chain'' [[Configuring chains\|custom chains]]. Then, by attaching simple rules to account the traffic, ie.		This example above assumes that you've already created the ''tcp-chain'', ''udp-chain'' and ''icmp-chain'' [[Configuring chains\|custom chains]]. Then, by attaching simple rules to account the traffic, ie.

	<source lang="bash">		<source lang="bash">

Pablo: Created page with "The ''dictionaries'', also known as ''verdict maps'', are one of the most interesting features available in ''nftables''. Basically, they allow you to attach an action to an e..."

2016-07-13T17:56:25Z

Created page with "The ''dictionaries'', also known as ''verdict maps'', are one of the most interesting features available in ''nftables''. Basically, they allow you to attach an action to an e..."

New page

The ''dictionaries'', also known as ''verdict maps'', are one of the most interesting features available in ''nftables''. Basically, they allow you to attach an action to an element. Dictionaries internally use the generic set infrastructure.

= Literal dictionaries =

The following example shows how to create a tree of chains that whose traversal depends on the layer 4 protocol type:

<source lang="bash">
% nft add rule ip filter input ip protocol vmap { tcp : jump tcp-chain, udp : jump udp-chain , icmp : jump icmp-chain }
% nft add rule ip filter input counter drop
</source>

This example above assumes that that you've already created the ''tcp-chain'', ''udp-chain'' and ''icmp-chain'' [[Configuring chains|custom chains]]. Then, by attaching simple rules to account the traffic, ie.

<source lang="bash">
% nft add rule filter icmp-chain counter
% nft add rule filter tcp-chain counter
% nft add rule filter udp-chain counter
</source>

You can check that the classification is already happening:

<source lang="bash">
% nft list table filter
table ip filter {
chain input {
type filter hook input priority 0;
ip protocol vmap { udp : jump udp-chain, tcp : jump tcp-chain, icmp : jump icmp-chain}
}

chain tcp-chain {
counter packets 4 bytes 520
}

chain udp-chain {
counter packets 4 bytes 678
}

chain icmp-chain {
counter packets 4 bytes 336
}
}
</source>

As you probably already noticed, one of the the good things of nftables is that you can use ''dictionaries'' to construct performance rule-sets. This rule-set arrangement allows you to reduce the amount of linear list inspections to classify your packets.

= Dictionary declarations =

You can also declarate dictionaries and populate its content dynamically, for example:

<source lang="bash">
% nft add map filter mydict { type ipv4_addr : verdict\; }
</source>

Then, you can add elements:

<source lang="bash">
% nft add element filter mydict { 192.168.0.10 : drop, 192.168.0.11 : accept }
</source>

You can bind this set to a rule using the following command:

<source lang="bash">
% nft add rule filter input ip saddr vmap @mydict
</source>

In case you want to build your own directionary, but you don't know what is the datatype name. Remember that you can inquire ''nft'' to know the datatype name:

<source lang="bash">
% nft describe tcp dport
payload expression, datatype inet_service (internet network service) (basetype integer), 16 bits
</source>

See the ''inet_service'' string after datatype.