[Bug 1179] New: vmap and sets cause "BUG: invalid range expression type set"

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Thu Aug 24 02:05:35 CEST 2017


            Bug ID: 1179
           Summary: vmap and sets cause "BUG: invalid range expression
                    type set"
           Product: nftables
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: major
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: netfilter at allycomm.com

Observed Behavior:

Use of sets within a vmap result in the error message:

BUG: invalid range expression type set
nft: expression.c:1037: range_expr_value_low: Assertion `0' failed.

Expected Behavior:

Could use both anonymous and named sets in a vmap

No "vmap" anywhere on <http://www.netfilter.org/projects/nftables/manpage.html>

No limitations given on the "match" portion of the dictionary in

Example .nft below, a simplified example of blocking "blackhole" IPv4
addresses, other than the expected ones.


The use of "sets" is crucial for managing non-contiguous ranges of IP addresses
that have various outcomes. While the IPv4 blackhole address space is
relatively small, there are presently over 88,000 entries in the IPv6 "bogons"

Assuming that sets will properly scale to this level, it is possible to use
individual tests for each of the outcomes. Using the vmap is a preferred
option, especially if one can define a "default" match option. 

To Replicate:

table inet global {

set blackhole_ipv4 {
    type ipv4_addr
    flags interval
    elements = {,        # "default",        # RFC 1918,         # bogon-bn-agg.txt 2017-08-17,        # loopback,        # Self-configured DHCP,        # RFC 1918,        # Vendor co-opted print servers,        # NET TEST,        # RFC 1918,        # RFC 2455 (NOT IANA; for Harvard,for BMWG),    # NeXT-Default:,        # RFC 3068,     # bogon-bn-agg.txt 2017-08-17,     # bogon-bn-agg.txt 2017-08-17,         # bogon-bn-agg.txt 2017-08-17        # broadcast

define if_external_net_ipv4 = { }
define if_external_addrs_ipv4 = {, }

chain drop_ext_prerouting_pre_nat {

    # Configured here for possiblity that the external interface
    # is on a blackhole net (for testing)
    # Reexamine after testing completed

    ip saddr vmap { $if_external_net_ipv4 : continue,
                        @blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_src }

    ip daddr vmap { $if_external_addrs_ipv4 : continue,
                        @blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_dst }




You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170824/0b4c2d3c/attachment.html>

More information about the netfilter-buglog mailing list