[Bug 1179] vmap and sets cause "BUG: invalid range expression type set"

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1179

--- Comment #1 from Jeff Kletsky <netfilter at allycomm.com> ---
Should someone come across this and have a similar application, the following
appears to meet the use case outlined above. Output from # nft list ruleset

table inet global {
    set blackhole_ipv4 {
        type ipv4_addr
        flags interval
        elements = { 0.0.0.0/8, 10.0.0.0/8,
                 100.64.0.0/10, 127.0.0.0/8,
                 169.254.0.0/16, 172.16.0.0/12,
                 192.0.0.0/24, 192.0.2.0/24,
                 192.18.0.0/15, 192.42.172.0/24,
                 192.88.99.0/24, 192.168.0.0/16,
                 198.51.100.0/24, 203.0.113.0/24,
                 224.0.0.0-255.255.255.255 }
    }

    chain drop_ext_prerouting_pre_nat {
        ip saddr != { 192.168.0.0/24 } ip saddr @blackhole_ipv4 log prefix
"Unacceptable blackhole src: " drop
        ip daddr != { 192.168.0.100, 192.168.6.255 } ip daddr @blackhole_ipv4
log prefix "Unacceptable blackhole dst: " drop
        return
    }
}

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170824/08126517/attachment-0001.html>