Log expression Flags key not implented

[greenpau]

Trying to add the following rule:

log prefix "ipv6 input drop: " flags all

The nft debug says:

  ip filter forward 
    [ log tcpseq tcpopt ipopt uid macdecode ]

The following snippet adds log prefix "ipv6 input drop: "

    r := &nftables.Rule{
        Table: tb,
        Chain: ch,
        Exprs: []expr.Any{},
    }

    r.Exprs = append(r.Exprs, &expr.Log{
        Key:  unix.NFTA_LOG_PREFIX,
        Data: []byte(prefix),
    })

The various keys are here:

nftables/expr/log.go

Lines 30 to 65 in c25e4f6

	func (e *Log) marshal() ([]byte, error) {
	var data []byte
	var err error
	switch e.Key {
	case unix.NFTA_LOG_GROUP:
	data, err = netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_LOG_GROUP, Data: e.Data},
	})
	case unix.NFTA_LOG_PREFIX:
	prefix := append(e.Data, '\x00')
	data, err = netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_LOG_PREFIX, Data: prefix},
	})
	case unix.NFTA_LOG_SNAPLEN:
	data, err = netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_LOG_SNAPLEN, Data: e.Data},
	})
	case unix.NFTA_LOG_QTHRESHOLD:
	data, err = netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_LOG_QTHRESHOLD, Data: e.Data},
	})
	case unix.NFTA_LOG_LEVEL:
	level := append(e.Data, '\x00')
	data, err = netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_LOG_LEVEL, Data: level},
	})
	}
	if err != nil {
	return nil, err
	}
	return netlink.MarshalAttributes([]netlink.Attribute{
	{Type: unix.NFTA_EXPR_NAME, Data: []byte("log\x00")},
	{Type: unix.NLA_F_NESTED | unix.NFTA_EXPR_DATA, Data: data},
	})
	}

However, it is unclear how to use this library to get flags all.

Reading through the various key, the tcpseq tcpopt ipopt uid macdecode do not popup. My guess is this is something that needs to be added to this library.

The nftables include/linux/netfilter/nf_tables.h contains the following snippet. It does refer to NFTA_LOG_FLAGS.

enum nft_log_attributes {
    NFTA_LOG_UNSPEC,
    NFTA_LOG_GROUP,
    NFTA_LOG_PREFIX,
    NFTA_LOG_SNAPLEN,
    NFTA_LOG_QTHRESHOLD,
    NFTA_LOG_LEVEL,
    NFTA_LOG_FLAGS,
    __NFTA_LOG_MAX
};

Perhaps there is a need to pass FF with NFTA_LOG_FLAGS? .. 🤔 ...

 * @NFTA_LOG_LEVEL: log level (NLA_U32)
 * @NFTA_LOG_FLAGS: logging flags (NLA_U32)