* Named sets with timeout
@ 2019-10-28 20:25 Matt
2019-10-29 0:23 ` Trent W. Buck
0 siblings, 1 reply; 6+ messages in thread
From: Matt @ 2019-10-28 20:25 UTC (permalink / raw)
To: netfilter, netfilter-owner
Dear nft Forum,
I’m a big friend of named sets, specially the timeout function is very
great.
But one thing is confusing me, assume the following named:
table ip filter_v4 {
set my_drop {
type ipv4_addr
flags timeout
}
...
...
}
Then i add the following sample element to it:
/usr/sbin/nft add set ip filter_v4 my_drop \{type ipv4_addr \; flags
timeout \; elements=\{a.b.c.d timeout 600s \} \;\}
All good so far, a.b.c.d is counting down as expected, begiing with
10min.
But when i wait - say 1 minute and repeat the 'nft add set ... 600s'
command from above then the timer remains unchanged (?)
It looks as the timer cannot get changed anymore once it has been
initialized
Is this behavior by purpose?
And if, am I right to delete the element and re-assign it if I want to
get the timer updated?
Many thanks
Matt
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Named sets with timeout
2019-10-28 20:25 Named sets with timeout Matt
@ 2019-10-29 0:23 ` Trent W. Buck
2019-10-29 1:35 ` Duncan Roe
2019-10-29 8:00 ` Laura Garcia
0 siblings, 2 replies; 6+ messages in thread
From: Trent W. Buck @ 2019-10-29 0:23 UTC (permalink / raw)
To: netfilter
Matt <matt-nft@mailtower.de> writes:
> Then i add the following sample element to it:
> /usr/sbin/nft add set ip filter_v4 my_drop \{type ipv4_addr \; flags
> timeout \; elements=\{a.b.c.d timeout 600s \} \;\}
>
> All good so far, a.b.c.d is counting down as expected,
> beginning with 10min.
> But when I wait - say 1 minute and repeat the 'nft add set ... 600s'
> command from above then the timer remains unchanged (?)
> It looks as the timer cannot get changed anymore once it has been
> initialized.
I think you are right, but see this recent commit (in 0.9.2+):
24f33c7 2019-06-17 18:15 +0200 LGL
src: enable set expiration date for set elements
https://git.netfilter.org/nftables/commit/?id=24f33c7
...which sounds like there is a new (as-yet-undocumented?) keyword for
changing (as opposed to initializing) the timeout of a set element.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Named sets with timeout
2019-10-29 0:23 ` Trent W. Buck
@ 2019-10-29 1:35 ` Duncan Roe
2019-10-29 8:00 ` Laura Garcia
1 sibling, 0 replies; 6+ messages in thread
From: Duncan Roe @ 2019-10-29 1:35 UTC (permalink / raw)
To: netfilter; +Cc: matt-nft, trentbuck
On Tue, Oct 29, 2019 at 11:23:40AM +1100, Trent W. Buck wrote:
> Matt <matt-nft@mailtower.de> writes:
>
> > Then i add the following sample element to it:
> > /usr/sbin/nft add set ip filter_v4 my_drop \{type ipv4_addr \; flags
> > timeout \; elements=\{a.b.c.d timeout 600s \} \;\}
> >
> > All good so far, a.b.c.d is counting down as expected,
> > beginning with 10min.
> > But when I wait - say 1 minute and repeat the 'nft add set ... 600s'
> > command from above then the timer remains unchanged (?)
> > It looks as the timer cannot get changed anymore once it has been
> > initialized.
>
> I think you are right, but see this recent commit (in 0.9.2+):
>
> 24f33c7 2019-06-17 18:15 +0200 LGL
> src: enable set expiration date for set elements
>
> https://git.netfilter.org/nftables/commit/?id=24f33c7
>
> ...which sounds like there is a new (as-yet-undocumented?) keyword for
> changing (as opposed to initializing) the timeout of a set element.
>
It's "update"
I.e. use update instead of add got get timeout to reset.
Needs kernel 5.3 IIRC
Cheers ... Duncan.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: Named sets with timeout
2019-10-29 0:23 ` Trent W. Buck
2019-10-29 1:35 ` Duncan Roe
@ 2019-10-29 8:00 ` Laura Garcia
2019-10-30 1:12 ` Trent W. Buck
1 sibling, 1 reply; 6+ messages in thread
From: Laura Garcia @ 2019-10-29 8:00 UTC (permalink / raw)
To: Trent W. Buck; +Cc: Mail List - Netfilter
On Tue, Oct 29, 2019 at 8:00 AM Trent W. Buck <trentbuck@gmail.com> wrote:
>
[...]
>
> I think you are right, but see this recent commit (in 0.9.2+):
>
> 24f33c7 2019-06-17 18:15 +0200 LGL
> src: enable set expiration date for set elements
>
> https://git.netfilter.org/nftables/commit/?id=24f33c7
>
> ...which sounds like there is a new (as-yet-undocumented?) keyword for
> changing (as opposed to initializing) the timeout of a set element.
>
Hi,
No new or undocumented keyword, it uses the already created syntax to
dump expiration values in order to modify it. Please refer to [1] and
[2].
As Duncan states, "update" is what you're looking for. Please check
the first example of [2].
[1] https://wiki.nftables.org/wiki-nftables/index.php/Element_timeouts
[2] https://wiki.nftables.org/wiki-nftables/index.php/Updating_sets_from_the_packet_path
Cheers.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-10-30 8:06 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-10-28 20:25 Named sets with timeout Matt
2019-10-29 0:23 ` Trent W. Buck
2019-10-29 1:35 ` Duncan Roe
2019-10-29 8:00 ` Laura Garcia
2019-10-30 1:12 ` Trent W. Buck
2019-10-30 8:06 ` Laura Garcia
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.