<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - disable implicit concatenating of elements of sets with flag interval"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1184#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - disable implicit concatenating of elements of sets with flag interval"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1184">bug 1184</a>
from <span class="vcard"><a class="email" href="mailto:netfilter@allycomm.com" title="Jeff Kletsky <netfilter@allycomm.com>"> <span class="fn">Jeff Kletsky</span></a>
</span></b>
<pre>As discussed on the nft mailing list on 2018-01-20
Prohibiting overlapping intervals in the same set is problematic on several
levels, including
* Dynamic firewalls, such as behavior-based ones
* Clear rule set definition
* Single-point management of addresses
The changes introduced by
commit 9a4b513014cfdeaad6d247b72a7924b3a536cfe9
Author: Phil Sutter <<a href="mailto:phil@nwl.cc">phil@nwl.cc</a>>
Date: Wed Jan 10 21:32:04 2018 +0100
src: Don't merge adjacent/overlapping ranges
Previously, when adding multiple ranges to a set they were merged if
overlapping or adjacent. This might cause inconvenience though since it
is afterwards not easily possible anymore to remove one of the merged
ranges again while keeping the others in place.
Since it is not possible to have overlapping ranges, this patch adds a
check for newly added ranges to make sure they don't overlap if merging
is turned off.
[...]
have broken rule sets here.
The changes break both explicit sets, as well as implicit sets within rules.
I am puzzled as to why "it is not possible to have overlapping ranges"
As long as the left/right of the interval are unique within the set, then the
element is unique.
I don't see any reason why a clear, efficient algorithm could not be developed
for overlapping intervals. If a user intentionally creates overlapping (or
contained) ranges, that is a conscious decision. Similarly, a dynamically
managed firewall should not have to read out the current state of the set to
decide how to add or remove a host or net block. At least for me, I would not
expect that the implementation would "magically optimize" the tests; I've
explicitly indicated two tests, I'm not going to be surprised if two
comparisons are done as a result.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>