<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:evil.function@proton.me" title="Eric Fahlgren <evil.function@proton.me>"> <span class="fn">Eric Fahlgren</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - Resetting the timeout counter for a named set element"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1689">bug 1689</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>evil.function@proton.me
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Resetting the timeout counter for a named set element"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1689#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Resetting the timeout counter for a named set element"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1689">bug 1689</a>
from <span class="vcard"><a class="email" href="mailto:evil.function@proton.me" title="Eric Fahlgren <evil.function@proton.me>"> <span class="fn">Eric Fahlgren</span></a>
</span></b>
<pre>Yes, but... Only in the packet path:
<a href="https://wiki.nftables.org/wiki-nftables/index.php/Updating_sets_from_the_packet_path">https://wiki.nftables.org/wiki-nftables/index.php/Updating_sets_from_the_packet_path</a>
It would be nice to be able to also do this from the command line. A
modification of current behavior could easily implement this, but a change in
semantics might cause issues with backward compatibility, so I'm not sure how
feasible this would be.
$ nft add set inet table my_set4 '{ type ipv4_addr; flags timeout,dynamic;
timeout 7d; }'
$ nft add element inet table my_set4 '{ 1.2.3.4 }'
Now list the set, see the element is there and the timeout is counting down.
Next, wait a minute or two and
$ nft add element inet table my_set4 '{ 1.2.3.4 expires 7d }'
List the set again, and it appears to simply confirm existence, then ignores
the 'expires' clause. If the semantics were changed to reset the expiration,
that would allow the desired result.
Alternatively, to avoid backward compatibility issues, leave 'add element'
as-is and add an 'update element' command, which would mimic the in-path rule
behavior. Looks like more work, but avoids breaking existing usage.
(Side note: my specific use case is updating DoH IP block lists from
out-of-band sources.)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>