<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - The -s option does not always exclude stateful information for sets"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1716#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - The -s option does not always exclude stateful information for sets"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1716">bug 1716</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to kfm from <a href="show_bug.cgi?id=1716#c0">comment #0</a>)
<span class="quote">> All of the following examples concern the exact same loaded ruleset.
>
> Here is an example of stateful information being properly omitted.
>
> # nft -s list set netdev filter block_bogons | head -n6
> table netdev filter {
> set block_bogons {
> type ipv4_addr
> flags interval,timeout
> timeout 1d
> elements = { 0.0.0.0/8, 10.0.0.0/8,
>
> Here is an example of stateful information not being omitted, despite the
> use of the -s option. The second address has been obfuscated for reasons of
> privacy.
>
> # nft -s list set netdev filter dropped | head -n7
> table netdev filter {
> set dropped {
> type ipv4_addr . ipv4_addr
> size 65535
> flags dynamic,timeout
> timeout 1h
> elements = { 146.88.240.17 . ___________ timeout 1h,</span >
-s/--stateful strips off 'expires' from the listing which tells you how much
time is left for this element to expire. The 'timeout' specify the timeout for
this element which might different from the default timeout.
<span class="quote">> Here is another example of stateful information not being omitted. The
> addresses have been obfuscated for reasons of privacy.
>
> # nft -s list set ip filter meter_client | head -n7
> table ip filter {
> set meter_client {
> type ipv4_addr
> size 131070
> flags dynamic,timeout
> timeout 2m30s
> elements = { ______________ limit rate 12/minute burst 30
> packets timeout 2m30s, _____________ limit rate 12/minute burst 30 packets
> timeout 2m30s,</span >
>
<span class="quote">> The expected outcome is that specifying the -s option consistently excludes
> the stateful information associated with the set elements.</span >
This shows 'limit rate' policy which does not exposed any internal stateful
information such as current tokens in the bucket compared to counter and quota.
Not related to this report but it should be possible to strip off 'timeout'
when it is the same as the default set timeout, to avoid repetitive printing of
the same timeout for every element, ie. only expires would be shown. In such
case, if -s/--stateful is specified, then expires would not be not shown.
For the record, 'expires' is stripped off from -s/--stateful since:
commit 37988cf255e51efba0d81dbc43eb4f0a41e99813
Author: Varsha Rao <<a href="mailto:rvarsha016@gmail.com">rvarsha016@gmail.com</a>>
Date: Tue Jun 6 11:55:40 2017 +0530
src: Remove expire information from list stateless ruleset.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>