On Sun, Apr 23, 2017 at 06:29:30PM +0800, Liping Zhang wrote:
> From: Liping Zhang <zlpnobody@xxxxxxxxx>
>
> Currently, after adding the following nft rules:
> # nft add set x target1 { type ipv4_addr \; flags timeout \;}
> # nft add rule x y set add ip daddr timeout 1d @target1 counter
>
> the counters will always be zero despite of the elements are added
> to the dynamic set "target1" or not, as we will break the nft expr
> traversal unconditionally:
> # nft list ruleset
> ...
> set target1 {
> ...
> elements = { 8.8.8.8 expires 23h59m53s}
> }
> chain output {
> ...
> set add ip daddr timeout 1d @target1 counter packets 0 bytes 0
> ^ ^
> ...
> }
>
> Since we add the elements to the set successfully, we should continue
> to the next expression.
>
> Additionally, if elements are added to "flow table" successfully, we
> will _always_ continue to the next expr, even if the operation is
> _OP_ADD. So it's better to keep them to be consistent.
Applied, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
