firehol / iprange

manage IP ranges
Other
197 stars 50 forks source link

iprange "--ipset-reduce" conflicting documentation #24

Open Jas0n99 opened 5 years ago

Jas0n99 commented 5 years ago

The man page of iprage says the option --ipset-reduce has "the internal default PERCENT is 20". Yet, when you don't use a number after the option strange things happen.

For instance:

iprange -v --ipset-reduce input.set > output.set

Will sit there and wait saying:

iprange: Loading from stdin

If you move the -v after the reduce:

iprange --ipset-reduce -v input.set > output.set

It appears to work, but it does NOT output any of the verbose content that it should.

Only way to get it to work as expected is to include the percentage amount, i.e.:

iprange -v --ipset-reduce 20 input.set > output.set

If you run without the -v or percent, it just sits there (presumably waiting for stdin).

iprange --ipset-reduce input.set > output.set

So I'm not sure if it's just the documentation not being real specific (what would be point be of saying what an internal default is if you must explicitly always specify it?) or an actual bug.

ktsaou commented 5 years ago

Yes, it does have an internal default. But there are 2 reduce parameters. From the iprange -h:

    --ipset-reduce PERCENT
    --reduce-factor PERCENT
        > IPSET REDUCE mode
        Merge all files and print the merged set,
        but try to reduce the number of prefixes (subnets)
        found, while allowing some increase in entries.
        The PERCENT is how much percent to allow increase
        on the number of entries in order to reduce
        the prefixes (subnets)
        (the internal default PERCENT is 20).
        Use -v to see exactly what it does.
        The resulting set is sorted.

    --ipset-reduce-entries ENTRIES
    --reduce-entries ENTRIES
        > IPSET REDUCE mode
        Allow increasing the entries above PERCENT,
        if they are below ENTRIES
        (the internal default ENTRIES is 16384).

So, to enable reduce mode you have to give either --ipset-reduce PERCENT or --ipset-reduce-entries ENTRIES. For the one not given in the parameters, the default will be used. But if you use one of these parameters, you have to overwrite its default value.

Jas0n99 commented 5 years ago

Ah okay, that makes sense, just not clearly documented anywhere... hehe...