Re: Why is ipset nethash set type limited to /31?

[Menno Smits <menno@netboxblue.com>]

Hi Jozsef,

Jozsef Kadlecsik wrote:
> Hi,
> 
> On Fri, 10 Mar 2006, Menno Smits wrote:
> 
>> Is there a reason why the ipset's nethash set type can't be used with
>> single IPs (/32) as well as larger networks? I'd really like to be able
>> to use networks and IPs in the same set.
> 
> An IP(v4) address is a 32bit number. A network address consists of an IP
> address and a mask value. In nethash the IP address *and* the mask
> together are stored on 32bits. Therefore it is not possible to store plain
> IP addresses in that type of sets.

Ok fair enough.

How would you feel about a "union" set type? Union sets would be
configured to refer to 1 or more other sets. If the IP is found in any
of the child sets it returns a match.

Example usage could be something like:

# ipset -N foo iphash
# ipset -A foo 192.168.0.1

# ipset -N bar nethash
# ipset -A bar 10.0.0.0/8

# ipset -N foobar union --set foo --set bar

# ipset -T foobar 192.168.0.1
192.168.0.1 is in set foobar.

# ipset -T foobar 10.1.2.3
10.1.2.3 is in set foobar.

# ipset -T foobar 192.168.0.2
192.168.0.2 is NOT in set foobar.

# ipset -T foobar 11.0.0.2
11.0.0.2 is NOT in set foobar.

Obviously the set types that could be used in the union would have to be 
compatible. Mixing an iphash and an ipportmap wouldn't make much sense.

Your thoughts?

Regards,
Menno