From 129f9d153279cd0fdb723fcff7d61879baa31f46 Mon Sep 17 00:00:00 2001 From: Devin Bayer Date: Thu, 1 Oct 2020 11:30:27 +0200 Subject: nft: migrate man page examples with `meter` directive to sets this updates the two examples in the man page that use the obsolete `meter` to use sets. I also fixed a bit of formatting for the conntrack expressions. Signed-off-by: Pablo Neira Ayuso --- doc/payload-expression.txt | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'doc/payload-expression.txt') diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt index e6f108b1..93d4d22f 100644 --- a/doc/payload-expression.txt +++ b/doc/payload-expression.txt @@ -642,6 +642,8 @@ zone id is tied to the given direction. + *ct* {*original* | *reply*} {*proto-src* | *proto-dst*} *ct* {*original* | *reply*} {*ip* | *ip6*} {*saddr* | *daddr*} +The conntrack-specific types in this table are described in the sub-section CONNTRACK TYPES above. + .Conntrack expressions [options="header"] |================== @@ -698,15 +700,15 @@ integer (64 bit) conntrack zone | integer (16 bit) |count| -count number of connections +number of current connections| integer (32 bit) |id| -Connection id -ct_id +Connection id| +ct_id| |========================================== -A description of conntrack-specific types listed above can be found sub-section CONNTRACK TYPES above. .restrict the number of parallel connections to a server -------------------- -filter input tcp dport 22 meter test { ip saddr ct count over 2 } reject +nft add set filter ssh_flood '{ type ipv4_addr; flags dynamic; }' +nft add rule filter input tcp dport 22 add @ssh_flood '{ ip saddr ct count over 2 }' reject -------------------- -- cgit v1.2.3