Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> On Mon, Dec 12, 2022 at 11:04:35AM +0100, Florian Westphal wrote:
> > Map updates can use timeouts, just like with sets, but the
> > linearization step did not pass this info to the kernel.
> >
> > meta l4proto tcp update @pinned { ip saddr . ct original proto-src : ip daddr . ct original proto-dst timeout 90s
> >
> > Listing this won't show the "timeout 90s" because kernel never saw it to
> > begin with.
> >
> > NB: The above line attaches the timeout to the data element,
> > but there are no separate timeouts for the key and the value.
> >
> > An alternative is to reject "key : value timeout X" from the parser
> > or evaluation step.
>
> You mean, timeout is accepted both from key : value sides of the
> mapping, right?
Yes, exactly, you can even to
ip saddr timeout 1m : 0x42 timeout 1s
> It makes more sense to restrict it to the key side, that would require
> a follow up patch.
Ok, works for me, should be easy to do.
