Re: expires larger than timeout causes error
"Kerin Millar" <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <[email protected]> |
On Mon, 30 Dec 2024, at 3:40 PM, Reindl Harald wrote:
> Am 30.12.24 um 16:19 schrieb lilydjwg:
>> On Sun, Dec 29, 2024 at 06:01:48PM +0100, Reindl Harald wrote:
>>>
>>> Am 29.12.24 um 11:00 schrieb lilydjwg:
>>>> I have an IPv4 set with timeout 2d, but update its elements to 4d when
>>>> a rule matches
>>>
>>> why?
>>
>> I just found it. With the timeout seperated, I could distinguish
>> frequent and active IPs from inactive / once
> you can't anyways that way - when the remaining value is 1 day you have
> no clue if it started with 2 or 4
They can.
# nft 'table ip t { set s { type ipv4_addr; timeout 2d; }; }'
# nft 'add element ip t s { 1.2.3.4 }'
# nft 'add element ip t s { 1.2.3.5 timeout 4d }'
# nft list set ip t s
table ip t {
set s {
type ipv4_addr
timeout 2d
elements = { 1.2.3.4 expires 1d23h59m54s923ms, 1.2.3.5 timeout 4d expires 3d23h59m58s323ms }
}
}
--
Kerin Millar