cloudgw: syntax error in nftables config if using sets with intervals and some element overlaps an interval
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	aborrero
	Sep 15 2023, 10:30 AM

Description

I detected this error:

aborrero@cloudgw1001:~ $ sudo nft -f /etc/nftables/main.nft
In file included from /etc/nftables/main.nft:9:1-36:
/etc/nftables/001_cloudgw_puppet.nft:30:21-33: Error: conflicting intervals specified
                    185.15.56.161 ,
                    ^^^^^^^^^^^^^~
In file included from /etc/nftables/main.nft:9:1-36:
/etc/nftables/001_cloudgw_puppet.nft:9:9-20: Error: Could not process rule: File exists
    set dmz_cidr_set {
        ^^^^^^^^^^^^

This is because the set contains both 185.15.56.161 and 185.15.56.0/24, and they overlap.

Details

	Subject	Repo	Branch	Lines +/-
	Add auto-merge to nftables sets where needed	operations/puppet	production	+3 -0
	cloudgw: enable set auto-merge	operations/puppet	production	+4 -0

Customize query in gerrit

Event Timeline

aborrero created this task.Sep 15 2023, 10:30 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 15 2023, 10:30 AM

aborrero changed the task status from Open to In Progress.Sep 15 2023, 10:30 AM

aborrero triaged this task as High priority.

aborrero moved this task from Backlog to Doing on the User-aborrero board.

Mentioned in SAL (#wikimedia-cloud) [2023-09-15T10:32:57Z] <arturo> faiolver cloudgw1001 into cloudgw1002, investigating a nftables syntax error (T346432)