<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Problems with dynamically managing interval sets with auto-merge"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1404">1404</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Problems with dynamically managing interval sets with auto-merge
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>blocker
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>pc@hillside.co.uk
</td>
</tr></table>
<p>
<div>
<pre>When element contents are auto-merged, a flush action will remove set elements
but seems to not permit elements to be added in the same command sequence.
Step 1:
Place following into a file (assumes ip filter table exists) to create a set
with a merged interval.
add set ip filter w_all {type ipv4_addr; flags interval;auto-merge}
add element ip filter w_all {10.10.10.10,10.10.10.11}
Step 2:
Assume time passes and a change is needed. Now in a second file, execute:
flush set ip filter w_all
add element ip filter w_all {10.10.10.10,10.10.10.253}
The add element command fails with
n2:2:30-40: Error: interval overlaps with an existing one
add element ip filter w_all {10.10.10.10,10.10.10.253}
^^^^^^^^^^^
n2:2:1-55: Error: Could not process rule: File exists
add element ip filter w_all {10.10.10.10,10.10.10.253}
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
and the set is unchanged.
Adding
flush set ip filter w_all
to the end of the first command set does result in an empty set. So it's
flushing, but I am guessing there is some state which retains the auto-merge
information which isn't cleared and this causes the second add element to fail.
Workaround 1:
Removing auto-merge from the set definition allows the contents to be replaced.
Workaround 2:
A workaround seems to be to split the second command set into two separate
calls to nft. First to flush the set. Then a second action to re-populate.
However, I really expect the flush to work.
Comments: An attempt to delete one element of an auto-merged element fails. I
think that this is reasonable.
# nft -v
nftables v0.9.3 (Topsy)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>