<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:fw@strlen.de" title="Florian Westphal <fw@strlen.de>"> <span class="fn">Florian Westphal</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - [REGRESSION] nft cannot load big set anymore"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1228">bug 1228</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>fw@strlen.de
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [REGRESSION] nft cannot load big set anymore"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1228#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [REGRESSION] nft cannot load big set anymore"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1228">bug 1228</a>
from <span class="vcard"><a class="email" href="mailto:fw@strlen.de" title="Florian Westphal <fw@strlen.de>"> <span class="fn">Florian Westphal</span></a>
</span></b>
<pre>(In reply to Oleksandr Natalenko from <a href="show_bug.cgi?id=1228#c0">comment #0</a>)
[..]
<span class="quote">> I think this has something to do with the changes related to checking for
> overlapping ranges introduced in v0.8.1.
>
> Here is how the set gets loaded:
>
> ===
> …
> table inet filter {
> set blackhole {
> type ipv4_addr
> flags interval
> include "/etc/nftables-blackhole.conf"
> }
> …
> ===
>
> I'm attaching the nftables-blackhole.conf file to this ticket too.</span >
Thanks for the detailed info.
Caused by commit 9a4b513014cfdeaad6d247b72a7924b3a536cfe9 (refs/bisect/bad)
src: Don't merge adjacent/overlapping ranges
<span class="quote">> Could you please fix this?</span >
We will look at fixing this, in the mean time, you should be able to get
performance (and old behaviour) back by adding auto-merge keyword:
table inet filter {
set blackhole {
type ipv4_addr
auto-merge
flags interval
include "/etc/nftables-blackhole.conf"
}
This restores old behaviour and makes nft not check for overlapping
addresses.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>