<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - meta hour error with different time-zones"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1737#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - meta hour error with different time-zones"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1737">bug 1737</a>
from <span class="vcard"><a class="email" href="mailto:pablo@netfilter.org" title="Pablo Neira Ayuso <pablo@netfilter.org>"> <span class="fn">Pablo Neira Ayuso</span></a>
</span></b>
<pre>(In reply to Simon G. Trajkovski from <a href="show_bug.cgi?id=1737#c3">comment #3</a>)
<span class="quote">> (In reply to nicolasfort1988 from <a href="show_bug.cgi?id=1737#c0">comment #0</a>)
> > When using meta hour, and also using different time zone (for example
> > Australia/Sydney), rules are written correctly, but they do not match as
> > expected.
> >
> >
> > ### Config and date
> > For example:
> >
> > table ip vyos_filter {
> > chain VYOS_OUTPUT_filter {
> > type filter hook output priority filter; policy accept;
> > ip daddr 1.1.1.1 meta hour >= "03:01" meta hour < "08:00"
> > counter packets 1 bytes 84 accept comment "ipv4-OUT-filter-10"
> > ip daddr 8.8.8.8 meta hour >= "03:01" meta hour < "14:00"
> > counter packets 0 bytes 0 accept comment "ipv4-OUT-filter-20"
>
> use a range:
>
> ip daddr 8.8.8.8 meta hour "03:01"-"08:00" counter packets
> 1 bytes 84 accept comment "ipv4-OUT-filter-10"
>
> and it works fine; but listing displays this :
>
> ip daddr 8.8.8.8 meta hour != "14:00"-"03:01" counter
> packets 1 bytes 84 accept comment "ipv4-OUT-filter-10"
>
> not knowledgeable of this code, but nftables/src/evaluate.c has special
> handling for this.</span >
Thanks for disentangling this bug report.
I made this patch:
<a href="https://patchwork.ozlabs.org/project/netfilter-devel/patch/20240319192609.218891-1-pablo@netfilter.org/">https://patchwork.ozlabs.org/project/netfilter-devel/patch/20240319192609.218891-1-pablo@netfilter.org/</a>
so it is the implicit cross-day handling that is reversing an interval what it
is missing in this ruleset.
So, basically, 14:00-03:01 triggers a cross-day interval swap in AEDT time,
since kernel handles time in UTC.
To improve usability, I have completed the remaining code in the listing path
and I have documented that use of ranges is recommended.
<a href="https://patchwork.ozlabs.org/project/netfilter-devel/patch/20240319192609.218891-1-pablo@netfilter.org/">https://patchwork.ozlabs.org/project/netfilter-devel/patch/20240319192609.218891-1-pablo@netfilter.org/</a>
it should be possible to make this change to swap this opencoded range
notation:
meta hour >= "03:01" meta hour < "14:00"
but it is still more efficient to express this with a range expression.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>