From a55ca1a24b7b216144dc737f621fb68f4a924e38 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 24 Aug 2018 09:52:22 +0200 Subject: src: integrate stateful expressions into sets and maps The following example shows how to populate a set from the packet path using the destination IP address, for each entry there is a counter. The entry expires after the 1 hour timeout if no packets matching this entry are seen. table ip x { set xyz { type ipv4_addr size 65535 flags dynamic,timeout timeout 1h } chain y { type filter hook output priority filter; policy accept; update @xyz { ip daddr counter } counter } } Similar example, that creates a mapping better IP address and mark, where the mark is assigned using an incremental sequence generator from 0 to 1 inclusive. table ip x { map xyz { type ipv4_addr : mark size 65535 flags dynamic,timeout timeout 1h } chain y { type filter hook input priority filter; policy accept; update @xyz { ip saddr counter : numgen inc mod 2 } } } Supported stateful statements are: limit, quota, counter and connlimit. Signed-off-by: Pablo Neira Ayuso --- src/rule.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'src/rule.c') diff --git a/src/rule.c b/src/rule.c index aef43638..470b112e 100644 --- a/src/rule.c +++ b/src/rule.c @@ -336,10 +336,11 @@ static void set_print_declaration(const struct set *set, const char *type; uint32_t flags; - if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) - type = "map"; - else if (set->flags & NFT_SET_EVAL) + if ((set->flags & (NFT_SET_EVAL | NFT_SET_ANONYMOUS)) == + (NFT_SET_EVAL | NFT_SET_ANONYMOUS)) type = "meter"; + else if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) + type = "map"; else type = "set"; -- cgit v1.2.3