<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - fail to add missing element to nft sets after running some time - file exists"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1650#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_REOPENED "
title="REOPENED - fail to add missing element to nft sets after running some time - file exists"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1650">bug 1650</a>
from <span class="vcard"><a class="email" href="mailto:larkwang@gmail.com" title="Wang Jian <larkwang@gmail.com>"> <span class="fn">Wang Jian</span></a>
</span></b>
<pre>>
<span class="quote">> This internal:0:0-0 is incorrect error reporting.</span >
>
<span class="quote">> Could you run nftables with git HEAD? It contains this fix:</span >
>
<span class="quote">> commit 5e39a34b196d68b803911aa13066fef2f83dc98c
> Author: Pablo Neira Ayuso <<a href="mailto:pablo@netfilter.org">pablo@netfilter.org</a>>
> Date: Mon Mar 27 16:36:31 2023 +0200</span >
>
<span class="quote">> intervals: use expression location when translating to intervals</span >
>
<span class="quote">> Otherwise, internal location reports:</span >
>
<span class="quote">> # nft -f ruleset.nft
> internal:0:0-0: Error: Could not process rule: File exists</span >
>
<span class="quote">> after this patch:</span >
>
<span class="quote">> # nft -f ruleset.nft
> ruleset.nft:402:1-16: Error: Could not process rule: File exists
> 1.2.3.0/30,
> ^^^^^^^^^^^</span >
>
<span class="quote">> it fixes error reporting, so at least it is possible to know what element
> already exists. This will be included in the next release (1.0.8).</span >
>
<span class="quote">> Once error reporting is fixed, next step would be to validate whether EEXIST
> is legitimate or bogus, via listing the set to check for overlaps, you could
> also use 'get element' command.</span >
>
<span class="quote">> Thanks.</span >
The errors are emitted by dnsmasq which is linked with libnftnl, but it's not
convenient for me to replace libnftnl at this time.
I use dnsmasq ipset insertion as a reference and catch what element insertion
causes an error and use nftables from git HEAD to verify it.
I managed to catch such errors.
-- snip --
set TUNNELv4 {
type ipv4_addr
flags interval,timeout
timeout 6h
comment "through tunnel"
elements = {
<entries removed for clearness>
23.204.139.144 expires 4h53m56s420ms,
23.204.139.145 expires 4h53m56s420ms,
23.209.45.25 expires 5h59m39s492ms, 23.209.45.26
expires 2h49s692ms,
23.209.45.27 expires 5h59m39s496ms, 23.209.45.32
expires 5h59m39s484ms,
23.209.45.33 expires 5h59m39s488ms, 23.209.45.34
expires 5h59m39s496ms,
34.83.54.130 expires 1h59m38s616ms, 34.104.35.123
expires 5m25s176ms,
<entries removed for clearness>
}
-- snip --
But
-- snip --
# build/nftables/src/nft add element inet mangle TUNNELv4 { 23.209.45.72 }
Error: Could not process rule: File exists
add element inet mangle TUNNELv4 { 23.209.45.72 }
^^^^^^^^^^^^
-- snip --
The element is not in the set. I once thought the element was inserted and
expired and then couldn't be inserted again. But after looking at logs, I'd say
it had never been inserted before the first error.
After I reloaded nft ruleset, the insertion of this element can be successful.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>