[Bug 1716] New: The -s option does not always exclude stateful information for sets

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1716

            Bug ID: 1716
           Summary: The -s option does not always exclude stateful
                    information for sets
           Product: nftables
           Version: 1.0.x
          Hardware: x86_64
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: kfm at plushkava.net

All of the following examples concern the exact same loaded ruleset.

Here is an example of stateful information being properly omitted.

# nft -s list set netdev filter block_bogons | head -n6
table netdev filter {
        set block_bogons {
                type ipv4_addr
                flags interval,timeout
                timeout 1d
                elements = { 0.0.0.0/8, 10.0.0.0/8,

Here is an example of stateful information not being omitted, despite the use
of the -s option. The second address has been obfuscated for reasons of
privacy.

# nft -s list set netdev filter dropped | head -n7
table netdev filter {
        set dropped {
                type ipv4_addr . ipv4_addr
                size 65535
                flags dynamic,timeout
                timeout 1h
                elements = { 146.88.240.17 . ___________ timeout 1h,

Here is another example of stateful information not being omitted. The
addresses have been obfuscated for reasons of privacy.

# nft -s list set ip filter meter_client | head -n7
table ip filter {
        set meter_client {
                type ipv4_addr
                size 131070
                flags dynamic,timeout
                timeout 2m30s
                elements = { ______________ limit rate 12/minute burst 30
packets timeout 2m30s, _____________ limit rate 12/minute burst 30 packets
timeout 2m30s,

The expected outcome is that specifying the -s option consistently excludes the
stateful information associated with the set elements.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20231025/11dacd8a/attachment-0001.html>