<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Updating and destroying set elements"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1725#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Updating and destroying set elements"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1725">bug 1725</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to xnoreq from <a href="show_bug.cgi?id=1725#c0">comment #0</a>)
<span class="quote">> nftables 1.0.9
> Archlinux 6.5.9-arch2-1
>
> Currently, it does not seem to be possible to update elements for a set
> defined like this:
> table ip raw {
> set BLACKLIST {
> type ipv4_addr
> size 1024
> timeout 30d
> }
> }
>
> with something like:
> nft update element ip raw BLACKLIST '{ a.b.c.d timeout 10s }'
>
> Instead, a hack like this is required:
> nft add element ip raw BLACKLIST '{ a.b.c.d }'
> nft delete element ip raw BLACKLIST '{ a.b.c.d }'
> nft add element ip raw BLACKLIST '{ a.b.c.d timeout 10s }'
>
> The delete is required such that the add can set the updated timeout.
> The first add is necessary to prevent delete from failing in case the
> element did not exist before.
>
> Can we have an update command please? That would make this a lot easier.</span >
Some patches are already floating on the mailing list to allow for timeout
updates.
<span class="quote">> Also, there seems to be a "destroy" for entire sets. Imo, it would also make
> sense to have the same for set elements, like so:
> nft destroy element ip raw BLACKLIST '{ a.b.c.d }'
>
>
> Interestingly, in chapter SETS the man page specifies
> {add | delete | destroy} element
> but this fails if the element does not exist:
> nft destroy element ip raw BLACKLIST '{ a.b.c.d }'
> Error: Could not process rule: No such file or directory
> destroy element ip raw BLACKLIST { a.b.c.d }
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> In the chapter elements the man page specifies
> {add | create | delete | destroy | get | reset } element
> but does not describe most of these operations.</span >
This is a kernel bug:
<a href="https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231113194720.123421-1-pablo@netfilter.org/">https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231113194720.123421-1-pablo@netfilter.org/</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>