[Bug 1228] [REGRESSION] nft cannot load big set anymore

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Sun Feb 18 15:59:09 CET 2018


Florian Westphal <fw at strlen.de> changed:

           What    |Removed                     |Added
                 CC|                            |fw at strlen.de

--- Comment #1 from Florian Westphal <fw at strlen.de> ---
(In reply to Oleksandr Natalenko from comment #0)
> I think this has something to do with the changes related to checking for
> overlapping ranges introduced in v0.8.1.
> Here is how the set gets loaded:
> ===
>> table inet filter {
>        set blackhole {
>                type ipv4_addr
>                flags interval
>                include "/etc/nftables-blackhole.conf"
>        }
>> ===
> I'm attaching the nftables-blackhole.conf file to this ticket too.

Thanks for the detailed info.
Caused by commit 9a4b513014cfdeaad6d247b72a7924b3a536cfe9 (refs/bisect/bad)
src: Don't merge adjacent/overlapping ranges

> Could you please fix this?

We will look at fixing this, in the mean time, you should be able to get
performance (and old behaviour) back by adding auto-merge keyword:

table inet filter {
       set blackhole {
               type ipv4_addr
               flags interval
               include "/etc/nftables-blackhole.conf"

This restores old behaviour and makes nft not check for overlapping

You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180218/8ce80093/attachment.html>

More information about the netfilter-buglog mailing list