<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - vmap and sets cause "BUG: invalid range expression type set""
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1179">bug 1179</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>FIXED
</td>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEW
</td>
<td>RESOLVED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - vmap and sets cause "BUG: invalid range expression type set""
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1179#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - vmap and sets cause "BUG: invalid range expression type set""
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1179">bug 1179</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to Jeff Kletsky from <a href="show_bug.cgi?id=1179#c1">comment #1</a>)
<span class="quote">> Should someone come across this and have a similar application, the
> following appears to meet the use case outlined above. Output from # nft
> list ruleset
>
> table inet global {
> set blackhole_ipv4 {
> type ipv4_addr
> flags interval
> elements = { 0.0.0.0/8, 10.0.0.0/8,
> 100.64.0.0/10, 127.0.0.0/8,
> 169.254.0.0/16, 172.16.0.0/12,
> 192.0.0.0/24, 192.0.2.0/24,
> 192.18.0.0/15, 192.42.172.0/24,
> 192.88.99.0/24, 192.168.0.0/16,
> 198.51.100.0/24, 203.0.113.0/24,
> 224.0.0.0-255.255.255.255 }
> }
>
> chain drop_ext_prerouting_pre_nat {
> ip saddr != { 192.168.0.0/24 } ip saddr @blackhole_ipv4 log prefix
> "Unacceptable blackhole src: " drop
> ip daddr != { 192.168.0.100, 192.168.6.255 } ip daddr @blackhole_ipv4 log
> prefix "Unacceptable blackhole dst: " drop
> return
> }
> }</span >
(In reply to Jeff Kletsky from <a href="show_bug.cgi?id=1179#c1">comment #1</a>)
<span class="quote">> Should someone come across this and have a similar application, the
> following appears to meet the use case outlined above. Output from # nft
> list ruleset
>
> table inet global {
> set blackhole_ipv4 {
> type ipv4_addr
> flags interval
> elements = { 0.0.0.0/8, 10.0.0.0/8,
> 100.64.0.0/10, 127.0.0.0/8,
> 169.254.0.0/16, 172.16.0.0/12,
> 192.0.0.0/24, 192.0.2.0/24,
> 192.18.0.0/15, 192.42.172.0/24,
> 192.88.99.0/24, 192.168.0.0/16,
> 198.51.100.0/24, 203.0.113.0/24,
> 224.0.0.0-255.255.255.255 }
> }
>
> chain drop_ext_prerouting_pre_nat {
> ip saddr != { 192.168.0.0/24 } ip saddr @blackhole_ipv4 log prefix
> "Unacceptable blackhole src: " drop
> ip daddr != { 192.168.0.100, 192.168.6.255 } ip daddr @blackhole_ipv4 log
> prefix "Unacceptable blackhole dst: " drop
> return
> }
> }</span >
This ruleset works fine here with current nftables snapshot.
And the larger one in the initial release it is include a set as a key in a map
definition, which is not supported.
This is bailing out with:
# nft -f /tmp/lala
/tmp/lala:37:19-19: Error: syntax error, unexpected @, expecting comma or '}'
@blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_src }
^
/tmp/lala:40:19-19: Error: syntax error, unexpected @, expecting comma or '}'
@blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_dst }
^
root@salvia:/home/pablo/devel/scm/git-kernel/korg/nf# vi /tmp/lala
root@salvia:/home/pablo/devel/scm/git-kernel/korg/nf# nft -f /tmp/lala
/tmp/lala:37:19-19: Error: syntax error, unexpected @, expecting comma or '}'
@blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_src }
^
/tmp/lala:40:19-19: Error: syntax error, unexpected @, expecting comma or '}'
@blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_dst }
^
Closing.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>