[Bug 1228] [REGRESSION] nft cannot load big set anymore

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1228

Florian Westphal <fw at strlen.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fw at strlen.de

--- Comment #1 from Florian Westphal <fw at strlen.de> ---
(In reply to Oleksandr Natalenko from comment #0)
[..]
> I think this has something to do with the changes related to checking for
> overlapping ranges introduced in v0.8.1.
> 
> Here is how the set gets loaded:
> 
> ===
> …
> table inet filter {
>        set blackhole {
>                type ipv4_addr
>                flags interval
>                include "/etc/nftables-blackhole.conf"
>        }
> …
> ===
> 
> I'm attaching the nftables-blackhole.conf file to this ticket too.

Thanks for the detailed info.
Caused by commit 9a4b513014cfdeaad6d247b72a7924b3a536cfe9 (refs/bisect/bad)
src: Don't merge adjacent/overlapping ranges

> Could you please fix this?

We will look at fixing this, in the mean time, you should be able to get
performance (and old behaviour) back by adding auto-merge keyword:

table inet filter {
       set blackhole {
               type ipv4_addr
               auto-merge
               flags interval
               include "/etc/nftables-blackhole.conf"
       }

This restores old behaviour and makes nft not check for overlapping
addresses.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180218/8ce80093/attachment.html>