Skip to content

Conversation

@t-aleksander
Copy link
Contributor

wojcik91
wojcik91 previously approved these changes Aug 4, 2025
* merge adjacent elements

* update new tests
@wojcik91 wojcik91 changed the title Restore merging of IPs into ranges Merge adjacent IP subnets into ranges for nftables Aug 5, 2025
@wojcik91
Copy link
Contributor

wojcik91 commented Aug 5, 2025

This mimics the behavior of nft CLI - if elements in a given address list are adjacent, they are converted into a range and merged.

For example [10.0.10.2/31, 10.0.10.4/31] is converted into 10.0.10.2-10.0.10.5.

This resolves the original issue with nftables. In the future we might also consider skipping subnet extraction for source addrs altogether, since it seems confusing.

@wojcik91 wojcik91 merged commit 4a6d87b into main Aug 6, 2025
1 check passed
@wojcik91 wojcik91 deleted the acl-patch branch August 6, 2025 07:55
wojcik91 added a commit that referenced this pull request Aug 6, 2025
* restore merging of ips

* merge adjacent subnets for nft (#185)

* merge adjacent elements

* update new tests

* linter fixes

* linter fix

* review fixes

---------

Co-authored-by: Aleksander <[email protected]>
wojcik91 added a commit that referenced this pull request Sep 10, 2025
* Merge adjacent IP subnets into ranges for nftables  (#182)

* restore merging of ips

* merge adjacent subnets for nft (#185)

* merge adjacent elements

* update new tests

* linter fixes

* linter fix

* review fixes

---------

Co-authored-by: Maciek <[email protected]>
Co-authored-by: Maciej Wójcik <[email protected]>
Co-authored-by: Maciej Wójcik <[email protected]>

* bump version (#188)

* update dependencies

* update protos

* update core dependency

---------

Co-authored-by: Aleksander <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

NFT rule source addresses don't seem to take into account the first address in a subnet

4 participants