Re: [nftables/nft] nft equivalent of "ipset test"

["U.Mutlu" <um@mutluit.com>]

Pablo Neira Ayuso wrote on 10/18/23 11:36:
> On Tue, Oct 17, 2023 at 08:00:57PM -0400, imnozi@gmail.com wrote:
>> On Wed, 18 Oct 2023 00:36:37 +0200
>> "U.Mutlu" <um@mutluit.com> wrote:
>>
>>> ...
>>> Actualy I need to do this monster:   :-)
>>>
>>> IP="1.2.3.4"
>>> ! nft "get element inet mytable myset  { $IP }" > /dev/null 2>&1 && \
>>> ! nft "get element inet mytable myset2 { $IP }" > /dev/null 2>&1 && \
>>>     nft "add element inet mytable myset  { $IP }"
>>
>> Try using '||', akin to:
>
> Please, use 'nft create' for this, no need for an explicit test and
> then add from command line.
>
> The idiom above is an antipattern, because it is not atomic, the
> 'create' command provides a way to first test if the element exists
> (if so it fails) then add it.

Pablo, unfortunately your solution with 'create' cannot be used
in my above said special use-case of testing first in BOTH sets...

I just don't understand why the author cannot simply add a real 'test' 
function to the nft tool...
The logic is already in 'get element' and also in your 'create' method.

PS: I'm not yet subscribed to netfilter-dev, so CC may fail...