src: integrate stateful expressions into sets and maps

The following example shows how to populate a set from the packet path
using the destination IP address, for each entry there is a counter. The
entry expires after the 1 hour timeout if no packets matching this entry
are seen.

 table ip x {
        set xyz {
                type ipv4_addr
                size 65535
                flags dynamic,timeout
                timeout 1h
        }

        chain y {
                type filter hook output priority filter; policy accept;
                update @xyz { ip daddr counter } counter
        }
 }

Similar example, that creates a mapping better IP address and mark,
where the mark is assigned using an incremental sequence generator from
0 to 1 inclusive.

 table ip x {
        map xyz {
                type ipv4_addr : mark
                size 65535
                flags dynamic,timeout
                timeout 1h
        }

        chain y {
                type filter hook input priority filter; policy accept;
                update @xyz { ip saddr counter : numgen inc mod 2 }
        }
 }

Supported stateful statements are: limit, quota, counter and connlimit.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 4 insertions, 3 deletions

diff --git a/src/rule.c b/src/rule.c
index aef43638..470b112e 100644
--- a/src/rule.c
+++ b/src/rule.c
@@ -336,10 +336,11 @@ static void set_print_declaration(const struct set *set,
 	const char *type;
 	uint32_t flags;
 
-	if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
-		type = "map";
-	else if (set->flags & NFT_SET_EVAL)
+	if ((set->flags & (NFT_SET_EVAL | NFT_SET_ANONYMOUS)) ==
+				(NFT_SET_EVAL | NFT_SET_ANONYMOUS))
 		type = "meter";
+	else if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+		type = "map";
 	else
 		type = "set";