nftables: Counters Not Working with Sets of Type Interval

nftables: Counters Not Working with Sets of Type Interval

[Mike Dillinger]

Hello,

Recently, nftables added counters to sets.  I've been using it and it works fine with type ipv4_addr.  However, I have a set with with type ipv4_addr and the interval flag is set.  I then add CIDR's to the set but do not see any counters when an IP address within the set interval range does something.  This may be intentional with intervals though, meaning counters intentionally don't work with intervals, but I thought I would check to confirm the intended implementation.

Thanks,
-MikeD

Re: nftables: Counters Not Working with Sets of Type Interval

[Pablo Neira Ayuso]

On Sun, Jul 05, 2020 at 06:25:57PM -0700, Mike Dillinger wrote:
> Hello,
> 
> Recently, nftables added counters to sets.  I've been using it and
> it works fine with type ipv4_addr.  However, I have a set with with
> type ipv4_addr and the interval flag is set.  I then add CIDR's to
> the set but do not see any counters when an IP address within the
> set interval range does something.  This may be intentional with
> intervals though, meaning counters intentionally don't work with
> intervals, but I thought I would check to confirm the intended
> implementation.

It's a bug in userspace nft, this patch fixes up this:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20200706111748.29601-1-pablo@netfilter.org/