Re: nftables: named set for ipv4 networks

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 27, 2016 at 11:41:52PM +0200, Leon Merten Lohse wrote:
> (repost to list. sorry for the duplicate)
> 
> Thank you, Pablo!
> Unfortunately this results in a segfault for me. I was able to boil the
> ruleset down to a minimal example that segfaults. 
> 
> # nft -f segfault.ruleset 
> Segmentation fault
> 
> Even if I made a severe error, it should not segfault, right? ..
> 
> Versions of nftables and kernel are as in my previous emails.
> 
> Best 
> Leon
> 
> ---
> 
> # segfault.ruleset
> 
> flush ruleset
> 
> table inet filter {
>   # blocked networks
>   set blacklist_v4 { type ipv4_addr; flags interval; }
> }
> 
> # this would be included from a generated file
> add element inet filter blacklist_v4 {
> 192.168.0.1/24,
> }

This is working here.

Your nft version is probably missing this patch:

http://git.netfilter.org/nftables/commit/?id=24c9e993eeff0ed41875aa7efef5dd69db4eb537

Could you please grab a nftables git.netfilter.org clone and confirm
this works for you?

We're planning for the nft 0.7 release, so it would be good if you can
help us confirm that the problem is already gone.

Thanks.