[BUG?] success of adding interval elements to map/set depends on order
Michal Soltys <[email protected]> Mon, 1 Jun 2026 14:19:12 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
Hi,
Consider the following ruleset file:
#!/usr/bin/nft -f
flush ruleset
table ip Main {
map snatmap {
typeof oifname . ip saddr : ip saddr
flags interval
elements = {
"egress0" . 10.192.0.88/29 comment "generic": 1.2.3.4,
"egress0" . 10.192.0.93 comment "sip": 5.6.7.8,
}
comment "SNAT map"
}
}
trying to load such ruleset fails with elements in this order will fail
with:
/etc/nftables-test.conf:10:25-61: Error: Could not process rule: File exists
"egress0" . 10.192.0.93 comment "sip": 5.6.7.8,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
But if we swap the order of those two elements so the more narrow one is
present earlier, the rules will load successfully. Same applies for
manual adding via "nft add element". And same happens if it was a
regular set instead of a map.
This should probably either fail in both cases, or succeed in both cases ?
Then there is also a question how that would/should behave in case of a
map, e.g. would
snat ip to oifname . ip saddr map @snatmap comment "snat map"
use 1.2.3.4 or 5.6.7.8 for 10.192.0.93 ?