<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - ipset save can result in add ... timeout 0 line"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1258">1258</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>ipset save can result in add ... timeout 0 line
</td>
</tr>
<tr>
<th>Product</th>
<td>ipset
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>minor
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>default
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>alexhacker64@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>ipset save command can result in "add ... timeout 0" line if the entry is about
to expire, which will keep the entry in table permanently upon reload
how to reproduce: add an entry to set with timeout and do ipset save each
second, when the entry is about to expire there is 1 second window when ipset
save will produce "timeout 0" entry.
ipset v6.29, protocol version: 6
while the probability of firing ipset save for some reason at the exact second
when the entry is about to expire is small, it may happen if amount of entries
in table is large upon reboot save, and may slowly but inevitably pollute table
with set timeout.
another possibility is if ipset save timing is somehow aligned / predicted by
attacker so that temporary entry in table becomes permanent.
because of small impact and probability of possible problems i think this is
minor bug, however it should be absolutely trivial to fix.
best possible solution is to add "timeout 1" entry instead for such items or do
not add them in ipset save output at all.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>