Skip to content

Merge adjacent IP subnets into ranges for nftables #182

Merged
wojcik91 merged 5 commits intomainfrom
acl-patch
Aug 6, 2025
Merged

Merge adjacent IP subnets into ranges for nftables #182
wojcik91 merged 5 commits intomainfrom
acl-patch

Conversation

@t-aleksander
Copy link
Copy Markdown
Contributor

wojcik91
wojcik91 previously approved these changes Aug 4, 2025
* merge adjacent elements

* update new tests
@wojcik91 wojcik91 changed the title Restore merging of IPs into ranges Merge adjacent IP subnets into ranges for nftables Aug 5, 2025
@wojcik91
Copy link
Copy Markdown
Contributor

wojcik91 commented Aug 5, 2025

This mimics the behavior of nft CLI - if elements in a given address list are adjacent, they are converted into a range and merged.

For example [10.0.10.2/31, 10.0.10.4/31] is converted into 10.0.10.2-10.0.10.5.

This resolves the original issue with nftables. In the future we might also consider skipping subnet extraction for source addrs altogether, since it seems confusing.

@wojcik91 wojcik91 merged commit 4a6d87b into main Aug 6, 2025
1 check passed
@wojcik91 wojcik91 deleted the acl-patch branch August 6, 2025 07:55
wojcik91 added a commit that referenced this pull request Aug 6, 2025
* restore merging of ips

* merge adjacent subnets for nft (#185)

* merge adjacent elements

* update new tests

* linter fixes

* linter fix

* review fixes

---------

Co-authored-by: Aleksander <170264518+t-aleksander@users.noreply.github.com>
wojcik91 added a commit that referenced this pull request Sep 10, 2025
* Merge adjacent IP subnets into ranges for nftables  (#182)

* restore merging of ips

* merge adjacent subnets for nft (#185)

* merge adjacent elements

* update new tests

* linter fixes

* linter fix

* review fixes

---------

Co-authored-by: Maciek <19913370+wojcik91@users.noreply.github.com>
Co-authored-by: Maciej Wójcik <maciek@wjck.pl>
Co-authored-by: Maciej Wójcik <maciej@defguard.net>

* bump version (#188)

* update dependencies

* update protos

* update core dependency

---------

Co-authored-by: Aleksander <170264518+t-aleksander@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

NFT rule source addresses don't seem to take into account the first address in a subnet

3 participants