* repeated nft set add ignores changed parameters
@ 2022-12-16 11:16 Florian Westphal
0 siblings, 0 replies; only message in thread
From: Florian Westphal @ 2022-12-16 11:16 UTC (permalink / raw)
To: netfilter-devel; +Cc: ffmancera
When re-adding an existing set no error is returned
and any changed parameters are ignored.
$ nft list ruleset | tee A
table ip nat {
map m {
typeof meta mark : ip saddr
flags dynamic,timeout timeout 1h
}
}
}
$ $EDITOR $A # change timeout
grep timeout\ A
timeout 1m
$ nft -f A
$ nft list ruleset|grep timeout\
timeout 1h
Is this a bug? Is there really no alternative than to completely
zap the entire set/map?
Similar issue:
adding set bla, followed by map bla passes without error but 'map bla'
gets ignored.
On a related note, what happened to 'netfilter: nf_tables: add support
to destroy operation':
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20221028100531.58666-1-ffmancera@riseup.net/
?
Some people are (rightfully) complaining that they need to do stupid
'add','delete' (or even add/delete/add!) games.
I don't really mind if we go with new commands (Fernandos patch), if we
change behaviour to ignore -ENOENT errors (in which case does it
makes sense to return an error...?) or if we add a nlmsg flag (kinda
inverse to NLMSG_F_EXCL), but current state is not nice at all.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-12-16 11:16 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-12-16 11:16 repeated nft set add ignores changed parameters Florian Westphal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).