Re: nftables and set with interval

["Serguei Bezverkhi (sbezverk)" <sbezverk@cisco.com>]

I have made a little progress, so now I build this from the code, but I do not think it totally right, because only 10.16.0.0/16 and 192.16.0.0/16 should show up, these three elements 
0.0.0.0-10.15.255.255, 10.17.0.0-192.15.255.255, 192.17.0.0-255.255.255.255 are supposed to be excluded.

sudo nft list table ipv4table
table ip ipv4table {
	set 246ae426f810 {
		type ipv4_addr
		flags constant,interval
		elements = { 0.0.0.0-10.15.255.255, 10.16.0.0/16,
			     10.17.0.0-192.15.255.255, 192.16.0.0/16,
			     192.17.0.0-255.255.255.255 }
	}

	chain ipv4chain-1 {
		type filter hook input priority filter; policy accept;
		ip daddr @246ae426f810 return comment "pU"
	}
}

In set with intervals, what attributes or how to indicate Exclusion SetElement?

Thank you
Serguei

On 2019-08-08, 9:19 AM, "Laura Garcia" <nevola@gmail.com> wrote:

    On Thu, Aug 8, 2019 at 1:56 PM Serguei Bezverkhi (sbezverk)
    <sbezverk@cisco.com> wrote:
    >
    > Hello,
    >
    > I am developing golang nftables libraryI am debugging nftables set with elements defining intervals. I compare what gets generated by nfl command and strace of my code.
    >
    > Based on the output of this command:
    >
    > sudo nft --debug all add rule ipv4table ipv4chain-1  ip daddr { 192.16.0.0/16, 10.16.0.0/16 } return
    >
    > It seems nft sets up NFTNL_SET_KEY_TYPE  (0x4) as 0x2 and I cannot find anywhere what it means.
    > {{nla_len=8, nla_type=0x4}, "\x00\x00\x00\x02"},
    >
    > When I decode strace generated for my code, it always gets set to x01
    > {{nla_len=8, nla_type=0x4}, "\x00\x00\x00\x01"},
    >
    
    Hi, are you interacting directly with netlink?
    Did you consider using the higher level library libnftables instead?
    
    Cheers.