<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - nft generates wrong intervals for sets with auto-merge"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1438">1438</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>nft generates wrong intervals for sets with auto-merge
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>public_timo.s@silentcreek.de
</td>
</tr></table>
<p>
<div>
<pre>Hi,
I'm relatively new to nftables, currently moving my iptables/ipset setups to
nftables. I did a few experiments with scripting sets and encountered the
following bug in nftables 0.9.0-2 (Debian 10) as well as 0.9.3-2 (Ubuntu
20.04).
If I have the following simple script to set up a set:
#!/usr/sbin/nft -f
add set inet filter myset { type ipv4_addr; flags interval; auto-merge }
add element inet filter myset { 192.168.0.0/24 }
add element inet filter myset { 192.168.0.2 }
add element inet filter myset { 192.168.1.0/24 }
add element inet filter myset { 192.168.1.100 }
After loading this script with `nft -f', I run `nft list set inet filter myset'
and the result looks like this:
table inet filter {
set myset {
type ipv4_addr
flags interval
auto-merge
elements = { 192.168.0.0/31, 192.168.0.2,
192.168.1.0-192.168.1.99, 192.168.1.100 }
}
}
Ouch! This is utterly wrong, obviously.
Please note that my experiments have shown that this bug occurs only if the
elements are added in individual `add element' statements in the script file.
If I put all elements in a single statement, the resulting set is correct, like
so:
add element inet filter myset { 192.168.0.0/24, 192.168.0.2, 192.168.1.0/24,
192.168.1.100 }
The resulting set is fine then and has only one element, as expected:
192.168.0.0/23
I understand that having multiple `add element' lines might not be ideal, but
the wiki doesn't suggest that this would be wrong (nor does `nft -cf'). Hence,
I consider this a major bug, since the auto-merged intervals do not at all
match what would be expected.
Cheers,
Timo</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>