In production I wanted to list two sets and count how many elements are in each:
$ sudo nft -json 'list set inet my_filter my_IPS_IPv4_blacklist' | jq '.nftables[1].set.elem | length'
33
When I tried to list both sets at once (IPv4 & IPv6), nft gave confusing errors.
Below is the smallest test ruleset I found that reproduces the problem.
bash5$ sudo ip netns add delete-me
bash5$ sudo ip netns exec delete-me nft 'flush ruleset; table inet x { set xs { type ipv4_addr; }; set ys { type ipv6_addr; }; }'
bash5$ sudo ip netns exec delete-me nft list ruleset
table inet x {
set xs {
type ipv4_addr
}
set ys {
type ipv6_addr
}
}
bash5$ sudo ip netns exec delete-me nft 'list set inet x xs'
table inet x {
set xs {
type ipv4_addr
}
}
bash5$ sudo ip netns exec delete-me nft 'list set inet x ys'
table inet x {
set ys {
type ipv6_addr
}
}
bash5$ sudo ip netns exec delete-me nft 'list set inet x xs; list set inet x xs'
table inet x {
set xs {
type ipv4_addr
}
}
table inet x {
set xs {
type ipv4_addr
}
}
bash5$ sudo ip netns exec delete-me nft 'list set inet x ys; list set inet x ys'
table inet x {
set ys {
type ipv6_addr
}
}
table inet x {
set ys {
type ipv6_addr
}
}
bash5$ sudo ip netns exec delete-me nft 'list set inet x xs; list set inet x ys'
Error: No such file or directory; did you mean set ‘ys’ in table inet ‘x’?
list set inet x xs; list set inet x ys
^^
bash5$ sudo ip netns exec delete-me nft 'list set inet x ys; list set inet x xs'
Error: No such file or directory; did you mean set ‘xs’ in table inet ‘x’?
list set inet x ys; list set inet x xs
^^
bash5$ /sbin/nft --version
nftables v1.0.6 (Lester Gooch #5)
bash5$ uname -a
Linux hera 6.5.0-0.deb12.4-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.5.10-1~bpo12+1 (2023-11-23) x86_64 GNU/Linux
bash5$ dpkg-query -W linux-image-amd64 nftables
linux-image-amd64 6.5.10-1~bpo12+1
nftables 1.0.6-2+deb12u2