[Bug 1179] vmap and sets cause "BUG: invalid range expression type set"

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1179

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #3 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Jeff Kletsky from comment #1)
> Should someone come across this and have a similar application, the
> following appears to meet the use case outlined above. Output from # nft
> list ruleset
> 
> table inet global {
> 	set blackhole_ipv4 {
> 		type ipv4_addr
> 		flags interval
> 		elements = { 0.0.0.0/8, 10.0.0.0/8,
> 			     100.64.0.0/10, 127.0.0.0/8,
> 			     169.254.0.0/16, 172.16.0.0/12,
> 			     192.0.0.0/24, 192.0.2.0/24,
> 			     192.18.0.0/15, 192.42.172.0/24,
> 			     192.88.99.0/24, 192.168.0.0/16,
> 			     198.51.100.0/24, 203.0.113.0/24,
> 			     224.0.0.0-255.255.255.255 }
> 	}
> 
> 	chain drop_ext_prerouting_pre_nat {
> 		ip saddr != { 192.168.0.0/24 } ip saddr @blackhole_ipv4 log prefix
> "Unacceptable blackhole src: " drop
> 		ip daddr != { 192.168.0.100, 192.168.6.255 } ip daddr @blackhole_ipv4 log
> prefix "Unacceptable blackhole dst: " drop
> 		return
> 	}
> }

(In reply to Jeff Kletsky from comment #1)
> Should someone come across this and have a similar application, the
> following appears to meet the use case outlined above. Output from # nft
> list ruleset
> 
> table inet global {
> 	set blackhole_ipv4 {
> 		type ipv4_addr
> 		flags interval
> 		elements = { 0.0.0.0/8, 10.0.0.0/8,
> 			     100.64.0.0/10, 127.0.0.0/8,
> 			     169.254.0.0/16, 172.16.0.0/12,
> 			     192.0.0.0/24, 192.0.2.0/24,
> 			     192.18.0.0/15, 192.42.172.0/24,
> 			     192.88.99.0/24, 192.168.0.0/16,
> 			     198.51.100.0/24, 203.0.113.0/24,
> 			     224.0.0.0-255.255.255.255 }
> 	}
> 
> 	chain drop_ext_prerouting_pre_nat {
> 		ip saddr != { 192.168.0.0/24 } ip saddr @blackhole_ipv4 log prefix
> "Unacceptable blackhole src: " drop
> 		ip daddr != { 192.168.0.100, 192.168.6.255 } ip daddr @blackhole_ipv4 log
> prefix "Unacceptable blackhole dst: " drop
> 		return
> 	}
> }

This ruleset works fine here with current nftables snapshot.

And the larger one in the initial release it is include a set as a key in a map
definition, which is not supported.

This is bailing out with:

# nft -f /tmp/lala 
/tmp/lala:37:19-19: Error: syntax error, unexpected @, expecting comma or '}'
                  @blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_src }
                  ^
/tmp/lala:40:19-19: Error: syntax error, unexpected @, expecting comma or '}'
                  @blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_dst }
                  ^
root at salvia:/home/pablo/devel/scm/git-kernel/korg/nf# vi /tmp/lala 
root at salvia:/home/pablo/devel/scm/git-kernel/korg/nf# nft -f /tmp/lala 
/tmp/lala:37:19-19: Error: syntax error, unexpected @, expecting comma or '}'
                  @blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_src }
                  ^
/tmp/lala:40:19-19: Error: syntax error, unexpected @, expecting comma or '}'
                  @blackhole_ipv4 : jump log_drop_ext_pre_pre_nat_dst }
                  ^

Closing.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200829/c5246c50/attachment-0001.html>