Why is ipset nethash set type limited to /31?
Hi all,
Is there a reason why the ipset's nethash set type can't be used with single IPs (/32) as well as larger networks? I'd really like to be able to use networks and IPs in the same set.
Regards,
Menno
Scanned by the NetBox from NetBox Blue
(http://netboxblue.com/)
Hi,
Quoted 3 lines · Menno Smits
Is there a reason why the ipset's nethash set type can't be used with single IPs (/32) as well as larger networks? I'd really like to be able to use networks and IPs in the same set.
An IP(v4) address is a 32bit number. A network address consists of an IP address and a mask value. In nethash the IP address *and* the mask together are stored on 32bits. Therefore it is not possible to store plain IP addresses in that type of sets.
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary
Hi Jozsef,
Quoted 4 lines · Jozsef Kadlecsik
Hi,
On Fri, 10 Mar 2006, Menno Smits wrote:
Quoted 8 lines
Quoted 3 lines
Is there a reason why the ipset's nethash set type can't be used with single IPs (/32) as well as larger networks? I'd really like to be able to use networks and IPs in the same set.
An IP(v4) address is a 32bit number. A network address consists of an IP address and a mask value. In nethash the IP address *and* the mask together are stored on 32bits. Therefore it is not possible to store plain IP addresses in that type of sets.
Ok fair enough.
How would you feel about a "union" set type? Union sets would be configured to refer to 1 or more other sets. If the IP is found in any of the child sets it returns a match.
Example usage could be something like:
# ipset -N foo iphash # ipset -A foo 192.168.0.1
# ipset -N bar nethash # ipset -A bar 10.0.0.0/8
# ipset -N foobar union --set foo --set bar
# ipset -T foobar 192.168.0.1 192.168.0.1 is in set foobar.
# ipset -T foobar 10.1.2.3 10.1.2.3 is in set foobar.
# ipset -T foobar 192.168.0.2 192.168.0.2 is NOT in set foobar.
# ipset -T foobar 11.0.0.2 11.0.0.2 is NOT in set foobar.
Obviously the set types that could be used in the union would have to be compatible. Mixing an iphash and an ipportmap wouldn't make much sense.
Your thoughts?
Regards,
Menno
Hi,
Quoted 3 lines · Menno Smits
How would you feel about a "union" set type? Union sets would be configured to refer to 1 or more other sets. If the IP is found in any of the child sets it returns a match.
Technically it is not difficult to add an union type. But first we'd like to complete the transition from sockopt to netlink based kernel-userspace communication (it involves the internal API of the settypes as well).
Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
H-1525 Budapest 114, POB. 49, Hungary