<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:neuroarmitage@proton.me" title="Simon G. Trajkovski <neuroarmitage@proton.me>"> <span class="fn">Simon G. Trajkovski</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - meta hour error with different time-zones"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1737">bug 1737</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>neuroarmitage@proton.me
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - meta hour error with different time-zones"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1737#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - meta hour error with different time-zones"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1737">bug 1737</a>
from <span class="vcard"><a class="email" href="mailto:neuroarmitage@proton.me" title="Simon G. Trajkovski <neuroarmitage@proton.me>"> <span class="fn">Simon G. Trajkovski</span></a>
</span></b>
<pre>(In reply to nicolasfort1988 from <a href="show_bug.cgi?id=1737#c0">comment #0</a>)
<span class="quote">> When using meta hour, and also using different time zone (for example
> Australia/Sydney), rules are written correctly, but they do not match as
> expected.
>
>
> ### Config and date
> For example:
>
> table ip vyos_filter {
> chain VYOS_OUTPUT_filter {
> type filter hook output priority filter; policy accept;
> ip daddr 1.1.1.1 meta hour >= "03:01" meta hour < "08:00"
> counter packets 1 bytes 84 accept comment "ipv4-OUT-filter-10"
> ip daddr 8.8.8.8 meta hour >= "03:01" meta hour < "14:00"
> counter packets 0 bytes 0 accept comment "ipv4-OUT-filter-20"</span >
use a range:
ip daddr 8.8.8.8 meta hour "03:01"-"08:00" counter packets 1
bytes 84 accept comment "ipv4-OUT-filter-10"
and it works fine; but listing displays this :
ip daddr 8.8.8.8 meta hour != "14:00"-"03:01" counter packets
1 bytes 84 accept comment "ipv4-OUT-filter-10"
not knowledgeable of this code, but nftables/src/evaluate.c has special
handling for this.
<span class="quote">> counter packets 76 bytes 5652 log prefix
> "[ipv4-OUT-filter-default-A]" accept comment "OUT-filter default-action
> accept"
> }
> }
>
> vyos@TEST:~$ date
> Fri Feb 23 07:19:16 AM AEDT 2024
> ###
>
> And after running ping to both hosts, we can check on logs that second rule
> was not hit, and we get log for last rule.
>
> ### Log
> Feb 23 07:19:33 TEST kernel: [ipv4-OUT-filter-default-A]IN= OUT=eth0
> SRC=192.168.0.151 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=30358 DF
> PROTO=ICMP TYPE=8 CODE=0 ID=48824 SEQ=1
> ####
>
>
> - nftables version: 1.0.9-1</span ></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>