pipapo_get_boundaries(9)

Welcome to pipapo_get_boundaries(9), bestie 💖 — this is the Kernel API Manual, and today’s main character energy is all about getting the byte interval for associated rules. Let’s go.

💖 NAME 💖

pipapo_get_boundaries — Get byte interval for associated rules. No cap.

✨ SYNOPSIS ✨

int pipapo_get_boundaries (struct nft_pipapo_field *f , int first_rule ,
int rule_count , u8 *left , u8 *right );

🎀 ARGUMENTS 🎀

• f — the field including the lookup table.
• first_rule — first rule (lowest index).
• rule_count — number of associated rules.
• left — byte expression for left boundary (start of range).
• right — byte expression for right boundary (end of range).

🦋 DESCRIPTION 🦋

Okay so here’s the vibe: given the first rule and amount of rules that originated from the same entry, this function builds the original range associated with the entry, and it calculates the length of the originating netmask. Obsessed.

In pictures:

bucket group  0   1   2   3   4   5   6   7   8   9  10  11  12  13  14
15 0                                                   1,2 1   1,2 2
1,2 3                                   1,2 4   1,2 5        1   2 6
1,2  1   1   1   1   1   1   1   1   1   1   1   1   1   1   1 7   1,2
1,2  1   1   1   1   1   1   1   1   1   1   1   1   1   1

This is the lookup table corresponding to the IPv4 range 192.168.1.0-192.168.2.1, which was expanded to the two composing netmasks, rule #1: 192.168.1.0/24, and rule #2: 192.168.2.0/31.

This function fills left and right with the byte values of the leftmost and rightmost bucket indices for the lowest and highest rule indices, respectively. If first_rule is 1 and rule_count is 2, we obtain, in nibbles: left: < 12, 0, 10, 8, 0, 1, 0, 0 > and right: < 12, 0, 10, 8, 0, 2, 2, 1 >, corresponding to bytes: left: < 192, 168, 1, 0 > and right: < 192, 168, 2, 1 >. The mask length is irrelevant here, unused on return, because the range is already defined by its start and end points. The mask length is relevant for a single ranged entry instead: if first_rule is 1 and rule_count is 1, we ignore rule 2 above: left becomes < 192, 168, 1, 0 >, right becomes < 192, 168, 1, 255 >, and the mask length, calculated from the distances between leftmost and rightmost bucket indices for each group, would be 24. Periodt.

🌸 RETURN 🌸

Mask length, in bits. That’s the whole return, bestie.

🌈 SEE ALSO 🌈

Go read these too, iykyk:

• Kernel file ./net/netfilter/nft_set_pipapo.c Theory of Operation(9)
• pipapo_refill(9)
• pipapo_get_slow(9)
• pipapo_get(9)
• nft_pipapo_lookup(9)
• nft_pipapo_get(9)
• pipapo_realloc_mt(9)
• lt_calculate_size(9)
• pipapo_resize(9)
• pipapo_bucket_set(9)
• pipapo_lt_4b_to_8b(9)
• pipapo_lt_8b_to_4b(9)
• pipapo_lt_bits_adjust(9)
• pipapo_insert(9)
• pipapo_step_diff(9)
• pipapo_step_after_end(9)
• pipapo_base_sum(9)
• pipapo_expand(9)
• pipapo_map(9)
• pipapo_free_scratch(9)
• pipapo_realloc_scratch(9)
• pipapo_maybe_clone(9)
• nft_pipapo_insert(9)
• pipapo_clone(9)
• pipapo_rules_same_key(9)
• pipapo_unmap(9)
• pipapo_drop(9)
• pipapo_gc_scan(9)
• pipapo_gc_queue(9)
• pipapo_free_fields(9)
• pipapo_reclaim_match(9)
• nft_pipapo_commit(9)
• nft_pipapo_activate(9)
• nft_pipapo_deactivate(9)
• nft_pipapo_flush(9)
• pipapo_match_field(9)
• nft_pipapo_remove(9)
• nft_pipapo_do_walk(9)
• nft_pipapo_walk(9)
• nft_pipapo_privsize(9)
• nft_pipapo_estimate(9)
• nft_pipapo_init(9)
• nft_set_pipapo_match_destroy(9)
• nft_pipapo_destroy(9)
• nft_pipapo_gc_init(9)

---

xoxo, your Unix bestie 💅 — source/version: ./net/netfilter; date: October 2026. That’s the footer, periodt. 🫶