<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - set update with timeout 0s removes timeout"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1249">1249</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>set update with timeout 0s removes timeout
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>minor
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>sub@ryper.org
</td>
</tr></table>
<p>
<div>
<pre>When trying to create some rules that essentially remove an IP from a set, I
found that adding a "timeout 0s" simply removes the timeout from the ruleset
when it gets loaded. Therefore, when trying to remove the IP by hitting port
2222, it simply resets the IP to the default timeout of 10m.
Is this a bug and if so could it be fixed? If not, would it be possible to
request a "set delete" feature to be able to remove elements from a set?
(current workaround is to set timeout 1s, but this is not perfect)
-------------------------------------------
#Config file:
table inet filter {
set test {
type ipv4_addr
timeout 10m
}
chain input {
type filter hook input priority 0; policy accept;
tcp dport 1111 set add ip saddr @test
tcp dport 2222 set update ip saddr timeout 0s @test
tcp dport 3333 set update ip saddr timeout 40s @test
}
... other chains ...
}
-------------------------------------------
-------------------------------------------
# nft list ruleset -nn
table inet filter {
set test {
type ipv4_addr
timeout 10m
elements = { 127.0.0.1 expires 4m21s }
}
chain input {
type filter hook input priority 0; policy accept;
tcp dport 1111 set add ip saddr @test
tcp dport 2222 set update ip saddr @test
tcp dport 3333 set update ip saddr timeout 1m40s @test
}
... other chains ...
}
-------------------------------------------
Thanks in advance!</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>