How to "resolve" an interface list?

Kentzo · Thu Jun 08, 2023 2:35 am

If I have an interface list with include and/or exclude references, is there a way to it to list all members in a script?

Amm0 · Thu Jun 08, 2023 2:46 am

Good question. I don't know if it's possible.

I used to use "include=" myself but stop since it was always confusing – I could not see what actual interfaces made up a interface-list if they used include= via CLI or script or winbox.

rextended · Thu Jun 08, 2023 10:10 am

If I have an interface list with include and/or exclude references, is there a way to it to list all members in a script?

probably yes, but a concrete exmple for work on?

pe1chl · Thu Jun 08, 2023 11:11 am

This is likely impossible. "interface lists" aren't really lists, they are bits set in a value related to every interface.
There does not seem to be a query function in RouterOS to ask which interfaces are (dynamic) member of a certain list.

rextended · Thu Jun 08, 2023 11:35 am

Just one example for make clear that is possible.

Start configuration code

/interface list add include=static name=test2 add include=test2 name=test1 /interface list member add interface=wlan1 list=test1

On the example is considered only the 1st item of each list, without ":foreach" just for example.

example code

/interface list :put [get [find where name=test1] include] >>> test2 /interface list :put [get [find where name=test2] include] >>> static (reserved keyword) /interface :put [get ([find where !dynamic]->0) name] >>> ether1 /interface list member :put ([get [find where list=test1]->0) interface] >>> wlan1 /interface list member :put [get ([find where list=test2]->0) interface] >>> (nothing)

pe1chl · Thu Jun 08, 2023 12:12 pm

My understanding is that when he has a list like the default "static" or "dynamic" lists, he wants to know which interfaces are member of that.
He does not want to get the word "static", he wants a list of all interfaces that are considered static.

Amm0 · Thu Jun 08, 2023 2:01 pm

I understand the problem as if you do something like this

/interface list add name=EXAMPLE include=WAN,dynamic exclude=LAN,static"

How do you get the list of members of the EXAMPLE list?

Not saying a script couldn'tpotentiallyget some list, but the lists can actually have multiple levels of hierechary too (e.g. /interface/list/add name=EXAMPLE2 include=EXAMPLE exclude=dynamic), it's not so simple.

IMO, issue is /interface/list/member/print only shows the actual interface assignment, but NOT ones that are "include=" by reference in the list. Ideally, the print show the results of the EXAMPLE list AFTER applying the include= & exclude= – like how "D" items appear in /ip/firewall/address-list for DNS names resolved.

rextended · Thu Jun 08, 2023 2:15 pm

My understanding is that when he has a list like the default "static" or "dynamic" lists, he wants to know which interfaces are member of that.
He does not want to get the word "static", he wants a list of all interfaces that are considered static.

/interface print where !dynamic

pe1chl · Thu Jun 08, 2023 2:22 pm

My understanding is that when he has a list like the default "static" or "dynamic" lists, he wants to know which interfaces are member of that.
He does not want to get the word "static", he wants a list of all interfaces that are considered static.
Code:Select all
/interface print where !dynamic

This was of course only an example. The actual situation is more complex than that, see the post by Amm0.
Also note that you can create your own dynamic lists, e.g. from a PPP profile.

rextended · Thu Jun 08, 2023 2:27 pm

# keyword: all /interface ; :foreach item in=[find] do={:put [get $item name]} # keyword: dynamic /interface ; :foreach item in=[find where dynamic] do={:put [get $item name]} # keyword: none # really.... # keyword: static /interface ; :foreach item in=[find where !dynamic] do={:put [get $item name]}

RouterOS prevent list loops (list1 contain list2 and list 2 contain list1...)

But on this case:

/interface list
add name=list-include
add name=list-exclude

add exclude=list-exclude include=list-include name=list3

/interface list member
add interface=ether1 list=list-include
add interface=ether1 list=list-exclude

The list 3 have included ether1 and at the same time is excluded...

Result: is excluded.
So, excluding comething take precedence.

So, first create list of included, and remove the excluded from the list, and do that for each exclude/include.......

rextended · Thu Jun 08, 2023 2:28 pm

This was of course only an example. The actual situation is more complex than that, see the post by Amm0.
Also note that you can create your own dynamic lists, e.g. from a PPP profile.

Yes, but without a concrete example, can't be clear what the user want do....

rextended · Thu Jun 08, 2023 2:43 pm

I understand the problem as if you do something like this
Code:Select all
/interface list add name=EXAMPLE include=WAN,dynamic exclude=LAN,static"
How do you get the list of members of the EXAMPLE list?

Not saying a script couldn'tpotentiallyget some list, but the lists can actually have multiple levels of hierechary too (e.g. /interface/list/add name=EXAMPLE2 include=EXAMPLE exclude=dynamic), it's not so simple.

IMO, issue is /interface/list/member/print only shows the actual interface assignment, but NOT ones that are "include=" by reference in the list. Ideally, the print show the results of the EXAMPLE list AFTER applying the include= & exclude= – like how "D" items appear in /ip/firewall/address-list for DNS names resolved.

without going into the ridiculousness of 3 or more linked lists, but remaining in practice...
and without going into the ridiculousness that one member of LAN is also a member of the WAN....

Just one fast example, without too much accuracy
/interface list add name=EXAMPLE include=WAN,dynamic exclude=LAN,static"

/interface :foreach item in=[find where dynamic or ([:len [:find [:tostr [list member find where list="WAN"]] [:tostr $".id"]]] > 0) ] do={ :put [get $item name] }

Amm0 · Thu Jun 08, 2023 3:18 pm

without going into the ridiculousness of 3 or more linked lists, but remaining in practice...
and without going into the ridiculousness that one member of LAN is also a member of the WAN....

Even if ridiculous, you might still what to see just how ridiculous it is, somehow

. These are typically used in a firewall, so as audit, be would good to know definitively what the actual interfaces the firewall would consider after processing include=/exclude=. Also why I stop using include= myself since "resolving by hand" get tricky quickly.

But more realistic is if you had a lot of VLANs and wanted to group them for the firewall, the top-level LAN might have include= of other lists (say "INTERNET_ONLY", "MGMT_ACCESS", "DMZ", etc.) used by firewall. You can obviously avoid by just putting an interface into multiple lists, but that isn't as structured as include= could be.

pe1chl · Thu Jun 08, 2023 3:30 pm

Yes, but without a concrete example, can't be clear what the user want do....

I think it is quite clear what he wants. And in general I do not like the "why would you want that??" approach to answering questions.

Amm0 · Thu Jun 08, 2023 3:33 pm

I don't doubt @rextended's scripting abilities – technically a script would be possible to resolve them but to cover all case, a complex one.

But these are used in a firewall, so kinda what know what RouterOS thinks the list is (e.g. what if the logic changes or bug...)

这听起来像一个功能的要求。

pe1chl · Thu Jun 08, 2023 4:06 pm

Yes, it would certainly be preferable when there was a read-only property of each list that returns the actual members of that list.

optio · Thu Jun 08, 2023 4:59 pm

Yes, it would certainly be preferable when there was a read-only property of each list that returns the actual members of that list.

同意,在Winbox上市/ Webfig wh将更清楚ich list includes/excludes interfaces

Screenshot 2023-06-08 at 15.55.19.png

rextended · Thu Jun 08, 2023 5:41 pm

Yes, but without a concrete example, can't be clear what the user want do....

I think it is quite clear what he wants. And in general I do not like the "why would you want that??" approach to answering questions.

Sorry, but in what sense?
I didn't ask him what he wants to do, but to be more specific,
Sorry, I didn't understand English well...

Amm0 · Thu Jun 08, 2023 7:07 pm

I tried to do this, but I didn't have time to deal with exclude=. Maybe this helps.

/interface list add name=CHILD1 include=dynamic /interface list add name=CHILD2 include=static /interface list add name=ROOT include=CHILD1,CHILD2 :global RESOLVEIFLIST do={ :global RESOLVEIFLIST :local iflist $1 :local mems :if ([:typeof $2] = "array") do={ :set mems $2 } else={ :set mems [:toarray ""]} #:put $iflist :set iflist [/interface list get [find name=$iflist]] #:put $iflist :if ([:typeof $iflist] != "array") do={ :error "list not found" } :do on-error={} { :set mems ($mems, [/interface list member get [find list=($iflist->"name")]]) } :local inc ($iflist->"include") :foreach imem in=$inc do={ #:put "imem = $imem" :if ($imem = "dynamic") do={ :foreach dname in=[/interface find where dynamic] do={:set mems ($mems,[/interface/get $dname name])} } else={ :if ($imem = "static") do={ :foreach dname in=[/interface find where !dynamic] do={:set mems ($mems,[/interface/get $dname name])} } else={ :set mems [$RESOLVEIFLIST $imem $mems] }} } :return $mems # todo: remove exclude= ... # :local excl ($iflist->"exclude") } :put [$RESOLVEIFLIST ROOT]

Kentzo · Thu Jun 08, 2023 7:48 pm

Just to clarify: I wanted a command that would list members of the list after building the dependency tree and then filtering per algorithm specified in the docs. This is useful mainly to verify that I got it right.