* Add element in set when element already present.
@ 2016-08-23 16:51 Mikaël Fourrier
2016-08-24 14:53 ` Pablo Neira Ayuso
0 siblings, 1 reply; 12+ messages in thread
From: Mikaël Fourrier @ 2016-08-23 16:51 UTC (permalink / raw)
To: netfilter
Hi,
When I add an element in a set (same with maps) and the set already
contains the element, the command fails with an error. Worse: I try to
add multiple elements and at least one of these elements is already in
the set, the command fails without adding any element. Why do you use
this semantic? It would be more ergonomic if you could just add elements
in a set without checking its content.
Have a good day,
Mikaël
Example:
```
# nft add set inet filter myset '{ type ipv4_addr; }'
# nft add element inet filter myset '{ 0.0.0.0 }'
# nft add element inet filter myset '{ 0.0.0.0 }'
<cmdline>:1:1-41: Error: Could not process rule: File exists
add element inet filter myset { 0.0.0.0 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft add element inet filter myset '{ 0.0.0.0, 1.1.1.1 }'
<cmdline>:1:1-50: Error: Could not process rule: File exists
add element inet filter myset { 0.0.0.0, 1.1.1.1 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft list set inet filter myset
set myset {
type ipv4_addr
elements = { 0.0.0.0}
}
```
Expected: no error and the set contains { 0.0.0.0, 1.1.1.1}.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-08-23 16:51 Add element in set when element already present Mikaël Fourrier
@ 2016-08-24 14:53 ` Pablo Neira Ayuso
2016-08-24 15:25 ` Yamakaky
0 siblings, 1 reply; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-24 14:53 UTC (permalink / raw)
To: Mikaël Fourrier; +Cc: netfilter
Hi,
On Tue, Aug 23, 2016 at 06:51:32PM +0200, Mikaël Fourrier wrote:
> Hi,
>
> When I add an element in a set (same with maps) and the set already contains
> the element, the command fails with an error. Worse: I try to add multiple
> elements and at least one of these elements is already in the set, the
> command fails without adding any element. Why do you use this semantic? It
> would be more ergonomic if you could just add elements in a set without
> checking its content.
Just sent a patchset to address this. Two for kernel:
http://patchwork.ozlabs.org/patch/662322/
http://patchwork.ozlabs.org/patch/662323/
Four for userspace (include two tests).
http://patchwork.ozlabs.org/patch/662333/
http://patchwork.ozlabs.org/patch/662331/
http://patchwork.ozlabs.org/patch/662332/
http://patchwork.ozlabs.org/patch/662330/
# nft add set inet filter myset { type ipv4_addr\; }
# nft add element inet filter myset { 0.0.0.0 }
# nft add element inet filter myset { 0.0.0.0 }
# nft create element inet filter myset { 0.0.0.0 }
<cmdline>:1:1-45: Error: Could not process rule: File exists
create element inet filter myset { 0.0.0.0 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The 'create' command complains if the element exists, the 'add'
command returns success if it already exists.
This basically provides the same semantics that we have already in
other objects.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-08-24 14:53 ` Pablo Neira Ayuso
@ 2016-08-24 15:25 ` Yamakaky
2016-08-26 9:09 ` Pablo Neira Ayuso
0 siblings, 1 reply; 12+ messages in thread
From: Yamakaky @ 2016-08-24 15:25 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter
Wow, that was fast!
I forgot to tell, but if I remember correctly there is the same problem
for maps.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-08-24 15:25 ` Yamakaky
@ 2016-08-26 9:09 ` Pablo Neira Ayuso
2016-08-26 17:41 ` Yamakaky
0 siblings, 1 reply; 12+ messages in thread
From: Pablo Neira Ayuso @ 2016-08-26 9:09 UTC (permalink / raw)
To: Yamakaky; +Cc: netfilter
On Wed, Aug 24, 2016 at 05:25:54PM +0200, Yamakaky wrote:
[...]
> I forgot to tell, but if I remember correctly there is the same problem for
> maps.
This will also work with maps:
# nft add table x
# nft add map x y { type ipv4_addr : ipv4_addr\; }
# nft add element x y { 1.1.1.1 : 2.2.2.2 }
# nft add element x y { 1.1.1.1 : 2.2.2.2 }
# nft create element x y { 1.1.1.1 : 2.2.2.2 }
<cmdline>:1:1-41: Error: Could not process rule: File exists
create element x y { 1.1.1.1 : 2.2.2.2 }
If you specify a different right hand side on the mapping, this hits
EBUSY at this moment if it differs from the initial value:
# nft add element x y { 1.1.1.1 : 2.2.2.3 }
<cmdline>:1:1-38: Error: Could not process rule: Device or resource busy
add element x y { 1.1.1.1 : 2.2.2.3 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
For sets with timeouts, it should be possible to support timeout
refresh in a follow up patch too.
Thanks!
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-08-26 9:09 ` Pablo Neira Ayuso
@ 2016-08-26 17:41 ` Yamakaky
0 siblings, 0 replies; 12+ messages in thread
From: Yamakaky @ 2016-08-26 17:41 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter
Wow, cool! Any idea about when it could be merged?
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
[not found] ` <000001d1fd88$03ad1770$0b074650$@verizon.net>
@ 2016-08-24 6:57 ` Yamakaky
0 siblings, 0 replies; 12+ messages in thread
From: Yamakaky @ 2016-08-24 6:57 UTC (permalink / raw)
To: netfilter
> I think that we can rely on the fact that set will not change, but see:
> https://en.wikipedia.org/wiki/Multiset
I'm sorry, I don't understand why you say that? I don't want a multiset
semantic, only a set semantic.
BTW, the error "File exists" is not really helpful.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-08-23 17:28 ` Roger Price
@ 2016-08-23 19:46 ` Yamakaky
[not found] ` <000001d1fd88$03ad1770$0b074650$@verizon.net>
0 siblings, 1 reply; 12+ messages in thread
From: Yamakaky @ 2016-08-23 19:46 UTC (permalink / raw)
To: netfilter
> Hi, The current behaviour corresponds to the mathematical definition
> of a set.
Which set operator acts like the current behavior? It seams to me that
union (add) and complement (remove) would be more ergonomic. For
example, a set could be used for banned IPs. Plus it's what every stdlib
does anyway. Is there something useful I miss with the current behavior?
> But you could always write a simple wrapper which feeds the elements
> one by one to "nft add element" and ignores the error messages for
> the duplicates.
That's what I did, but it's not very clean.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-08-23 16:53 Yamakaky
@ 2016-08-23 17:28 ` Roger Price
2016-08-23 19:46 ` Yamakaky
0 siblings, 1 reply; 12+ messages in thread
From: Roger Price @ 2016-08-23 17:28 UTC (permalink / raw)
To: netfilter
On Tue, 23 Aug 2016, Yamakaky wrote:
> When I add an element in a set (same with maps) and the set already
> contains the element, the command fails with an error.
Hi, The current behaviour corresponds to the mathematical definition of a
set. But you could always write a simple wrapper which feeds the elements
one by one to "nft add element" and ignores the error messages for the
duplicates.
> Expected: no error and the set contains { 0.0.0.0, 1.1.1.1}.
The simple wrapper would have your expected behaviour. What would be
helpful is a specific return code from "nft add element", and from ipset
for the same error.
Roger
^ permalink raw reply [flat|nested] 12+ messages in thread
* Add element in set when element already present.
@ 2016-08-23 16:53 Yamakaky
2016-08-23 17:28 ` Roger Price
0 siblings, 1 reply; 12+ messages in thread
From: Yamakaky @ 2016-08-23 16:53 UTC (permalink / raw)
To: netfilter
Hi,
When I add an element in a set (same with maps) and the set already
contains the element, the command fails with an error. Worse: I try to
add multiple elements and at least one of these elements is already in
the set, the command fails without adding any element. Why do you use
this semantic? It would be more ergonomic if you could just add elements
in a set without checking its content.
Have a good day,
Mikaël
Example:
```
# nft add set inet filter myset '{ type ipv4_addr; }'
# nft add element inet filter myset '{ 0.0.0.0 }'
# nft add element inet filter myset '{ 0.0.0.0 }'
<cmdline>:1:1-41: Error: Could not process rule: File exists
add element inet filter myset { 0.0.0.0 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft add element inet filter myset '{ 0.0.0.0, 1.1.1.1 }'
<cmdline>:1:1-50: Error: Could not process rule: File exists
add element inet filter myset { 0.0.0.0, 1.1.1.1 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft list set inet filter myset
set myset {
type ipv4_addr
elements = { 0.0.0.0}
}
```
Expected: no error and the set contains { 0.0.0.0, 1.1.1.1}.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-04-06 11:22 Mikaël Fourrier
2016-04-06 12:12 ` Mikaël Fourrier
@ 2016-04-06 12:15 ` Mikaël Fourrier
1 sibling, 0 replies; 12+ messages in thread
From: Mikaël Fourrier @ 2016-04-06 12:15 UTC (permalink / raw)
To: netfilter
It's the same idea with maps, BTW
(sorry if double post, network problems)
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: Add element in set when element already present.
2016-04-06 11:22 Mikaël Fourrier
@ 2016-04-06 12:12 ` Mikaël Fourrier
2016-04-06 12:15 ` Mikaël Fourrier
1 sibling, 0 replies; 12+ messages in thread
From: Mikaël Fourrier @ 2016-04-06 12:12 UTC (permalink / raw)
To: netfilter
The same applies to maps, BTW.
^ permalink raw reply [flat|nested] 12+ messages in thread
* Add element in set when element already present.
@ 2016-04-06 11:22 Mikaël Fourrier
2016-04-06 12:12 ` Mikaël Fourrier
2016-04-06 12:15 ` Mikaël Fourrier
0 siblings, 2 replies; 12+ messages in thread
From: Mikaël Fourrier @ 2016-04-06 11:22 UTC (permalink / raw)
To: netfilter
Hi,
When I add an element in a set and the set already contains the element,
the command fails with an error. Worse: I try to add multiple elements
and at least one of these elements is already in the set, the command
fails without adding any element. Why do you use this semantic? It would
be more ergonomic if you could just add elements in a set without
checking its content.
Have a good day,
Mikaël
Example:
```
# nft add set inet filter myset '{ type ipv4_addr; }'
# nft add element inet filter myset '{ 0.0.0.0 }'
# nft add element inet filter myset '{ 0.0.0.0 }'
<cmdline>:1:1-41: Error: Could not process rule: File exists
add element inet filter myset { 0.0.0.0 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft add element inet filter myset '{ 0.0.0.0, 1.1.1.1 }'
<cmdline>:1:1-50: Error: Could not process rule: File exists
add element inet filter myset { 0.0.0.0, 1.1.1.1 }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft list set inet filter myset
set myset {
type ipv4_addr
elements = { 0.0.0.0}
}
```
Expected: no error and the set contains { 0.0.0.0, 1.1.1.1}.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2016-08-26 17:41 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-08-23 16:51 Add element in set when element already present Mikaël Fourrier
2016-08-24 14:53 ` Pablo Neira Ayuso
2016-08-24 15:25 ` Yamakaky
2016-08-26 9:09 ` Pablo Neira Ayuso
2016-08-26 17:41 ` Yamakaky
-- strict thread matches above, loose matches on Subject: below --
2016-08-23 16:53 Yamakaky
2016-08-23 17:28 ` Roger Price
2016-08-23 19:46 ` Yamakaky
[not found] ` <000001d1fd88$03ad1770$0b074650$@verizon.net>
2016-08-24 6:57 ` Yamakaky
2016-04-06 11:22 Mikaël Fourrier
2016-04-06 12:12 ` Mikaël Fourrier
2016-04-06 12:15 ` Mikaël Fourrier
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.