Re: [PATCH nft 2/3] netlink_linearize: fix timeout with map updates

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Mon, Dec 12, 2022 at 11:04:35AM +0100, Florian Westphal wrote:
> > Map updates can use timeouts, just like with sets, but the
> > linearization step did not pass this info to the kernel.
> > 
> > meta l4proto tcp update @pinned { ip saddr . ct original proto-src : ip daddr . ct original proto-dst timeout 90s
> > 
> > Listing this won't show the "timeout 90s" because kernel never saw it to
> > begin with.
> > 
> > NB: The above line attaches the timeout to the data element,
> > but there are no separate timeouts for the key and the value.
> > 
> > An alternative is to reject "key : value timeout X" from the parser
> > or evaluation step.
> 
> You mean, timeout is accepted both from key : value sides of the
> mapping, right?

Yes, exactly, you can even to

ip saddr timeout 1m : 0x42 timeout 1s

> It makes more sense to restrict it to the key side, that would require
> a follow up patch.

Ok, works for me, should be easy to do.