Re: list elements of set

On Sat, 27 Sep 2025, at 9:06 AM, 0x1 | nftables wrote:
> Hello everyone,
>
> I would like to list all ipv4 elements of a named set. 
>
> the set is named
>
> mx_bans_cidr

This does not show the table in which the set resides, nor the address family associated with the table (which can be "ip", "ip6" or "inet"). It is the combination of these two things that qualifies any given table.

>
> the command i used:
>
> sudo nft list set ip filter mx_bans_cidr
>
> Error: No such file or directory
> list set ip filter mx_bans_cidr

The command is valid. It's simply stating that there is no set named "mx_bans_cidr" in the "ip filter" table. You might even not have a table named "ip filter" at all.

>
>
> I followed the description from this page
>
> https://wiki.nftables.org/wiki-nftables/index.php/Sets#Listing_named_sets
>
>
> The query for element in a set is also not working.
>
> I tried all kind of versions of the command, one that surprised me was:
>
>
> sudo nft get element ip basetable filter mx_bans_cidr { *.*.*.* }

Here, you specify a family of "ip" and a name of "basetable". But you also follow it with "filter", which doesn't make any sense. A table cannot have two names. Presumably, "ip basetable" would be correct in your case.

# nft 'list set ip basetable mx_bans_cidr'

If you have any doubt as to the naming of your tables, you could try listing all sets without their contents initially.

# nft -t 'list sets'

>
> Error: syntax error, unexpected string, expecting '{' or '$'
> get element ip basetable filter mx_bans_cidr { somefile-x.x.x.tar.gz
> someotherfile-y.y.y.tar.gz }
>
> Those are 2 files, that contain 4 dots in the filename, in the working
> directory ?!

Indeed. That's your shell performing pathname expansion in accordance with the Shell Command Language specification. This is why I always recommend that nft(8) commands be conveyed as a single word through the use of quoting, if issuing them from a shell. For example:

# nft 'list set ip basetable mx_bans_cidr'

Everything between the single quotes will be taken literally and passed along to nft(8) as a single argument. No pathname expansion is possible then.

I wrote some material for the wiki that also touches upon the use of the shell. See https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Syntactic_conventions.

-- 
Kerin Millar