ipset suggestion, idle-timeout

ipset suggestion, idle-timeout

[Shannon Wynter]

Greetings,

I would love to have an "idle timeout" for ipset

It would essentially work like the regular timeout, removing the entry 
from the set but only if no matches on the entry for the duration of the 
timeout

eg:
Add a match for 8.8.8.8 for 300 seconds.
If there is a match on 8.8.8.8 at 250 seconds then the timer is reset.
If there is no match on 8.8.8.8 for 300 then the entry is removed

I wouldn't mind having a look at this myself but don't really know the 
first thing about NF and I've already gotten lost in the source.

Re: ipset suggestion, idle-timeout

[Jozsef Kadlecsik]

On Mon, 21 Apr 2014, Shannon Wynter wrote:

> It would essentially work like the regular timeout, removing the entry from
> the set but only if no matches on the entry for the duration of the timeout
> 
> eg:
> Add a match for 8.8.8.8 for 300 seconds.
> If there is a match on 8.8.8.8 at 250 seconds then the timer is reset.
> If there is no match on 8.8.8.8 for 300 then the entry is removed
> 
> I wouldn't mind having a look at this myself but don't really know the first

That's equivalent with "match and re-add the element", which can easily be 
achieved with a rule like:

... -m set --match-set .... -j SET --add-set ...

(or if you need multiple actions, then jump to a proper chain).

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
          H-1525 Budapest 114, POB. 49, Hungary

Re: ipset suggestion, idle-timeout

[Shannon Wynter]

On 22/04/2014 5:25 AM, Jozsef Kadlecsik wrote:
> That's equivalent with "match and re-add the element", which can easily be
> achieved with a rule like:
>
> ... -m set --match-set .... -j SET --add-set ...
>
> (or if you need multiple actions, then jump to a proper chain).
>
> Best regards,
> Jozsef
>
Brilliant, my apologies, I've been using ipset for ages, have even read 
the manual a few times, must have missed the bit where it was telling me 
I could use iptables to add to sets (makes sense though)

Thank you

Shannon.