Re: nftables: named set for ipv4 networks

[Leon Merten Lohse <leon@green-side.de>]

(repost to list. sorry for the duplicate)

Thank you, Pablo!
Unfortunately this results in a segfault for me. I was able to boil the
ruleset down to a minimal example that segfaults. 

# nft -f segfault.ruleset 
Segmentation fault

Even if I made a severe error, it should not segfault, right? ..

Versions of nftables and kernel are as in my previous emails.

Best 
Leon

---

# segfault.ruleset

flush ruleset

table inet filter {
  # blocked networks
  set blacklist_v4 { type ipv4_addr; flags interval; }
}

# this would be included from a generated file
add element inet filter blacklist_v4 {
192.168.0.1/24,
}



On Thu, 27 Oct 2016 21:23:38 +0200
Pablo Neira Ayuso <pablo@netfilter.org> wrote:

> On Sun, Oct 23, 2016 at 09:38:22PM +0200, Leon Merten Lohse wrote:  
> > Hi,
> > 
> > is there a way to migrate a hash:net type ipset to nftables?
> > We use this to implement a blacklist where we block a large number
> > of networks.
> > 
> > I tried using a type ipv4_addr named set as follows:
> > 
> > flush ruleset
> > table inet filter {
> >   set blacklist_v4 { type ipv4_addr; }
> > }
> > add element inet filter blacklist_v4 { 10.0.0.0/8 }
> > 
> > However, this results in:
> > Error: Set member cannot be prefix, missing interval flag on
> > declaration add element inet filter blacklist_v4 { 10.0.0.0/8 }
> >                                        ^^^^^^^^^^
> > Is ipv4_addr the wrong type in this case? I could not find any
> > documentation on it.
> > Using networks in anonymous sets seems to work flawlessly.    
> 
> Missing "flags interval;" here, so this should be:
> 
>         table inet filter {
>            set blacklist_v4 { type ipv4_addr; flags interval; }
>         }
> 
> With named sets, you have to specify this flag since the kernel uses
> to select what is the best data structure uses to represent what you
> need.
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter"
> in the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html