IPSET050 - ipset Cannot Hold a Network

Agent error code #IPSET050 occurs when a knoc's predefined source is a network, such as 192.168.100.48/29, and the ipset the knoc points at stores single addresses rather than networks.

An ipset has a type, fixed when the set is created. A hash:net set stores networks. A hash:ip or bitmap:ip set stores one address per member and has nowhere to put a netmask. The kernel will accept a network on an address set by expanding it into one member per address, but that expansion is not the network any more: the set reads back as a list of addresses, so the agent sees the network as missing on every reconcile and re-applies it, and a range larger than the set's maxelem fills the set and then fails partway, leaving the addresses it did add with no grant to remove them. The agent refuses the grant rather than leave the set in that state.

Steps to Resolve

Point the Knoc at a hash:net Set

Create a set that holds networks and use it on the knoc:

ipset create knoc_net4 hash:net family inet timeout 0

Add it to your firewall rules the same way as the existing set, then set it as the knoc's IPv4 (or IPv6) set name. A hash:net set also holds single addresses, so one set can serve knocs that grant a host and knocs that grant a network.

Check Which Type the Existing Set Is

On the agent host:

ipset list -t <set-name>

The Type: line shows hash:ip, bitmap:ip or hash:net. Knocknoc reports each set it found, with its type, under the agent's capabilities in the admin portal.

Or Grant Single Addresses Instead

If the set has to stay as it is, change the knoc's predefined sources to single addresses. A knoc accepts up to five, so a small set of hosts can be listed individually.