From a55ca1a24b7b216144dc737f621fb68f4a924e38 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 24 Aug 2018 09:52:22 +0200
Subject: src: integrate stateful expressions into sets and maps

The following example shows how to populate a set from the packet path
using the destination IP address, for each entry there is a counter. The
entry expires after the 1 hour timeout if no packets matching this entry
are seen.

 table ip x {
        set xyz {
                type ipv4_addr
                size 65535
                flags dynamic,timeout
                timeout 1h
        }

        chain y {
                type filter hook output priority filter; policy accept;
                update @xyz { ip daddr counter } counter
        }
 }

Similar example, that creates a mapping better IP address and mark,
where the mark is assigned using an incremental sequence generator from
0 to 1 inclusive.

 table ip x {
        map xyz {
                type ipv4_addr : mark
                size 65535
                flags dynamic,timeout
                timeout 1h
        }

        chain y {
                type filter hook input priority filter; policy accept;
                update @xyz { ip saddr counter : numgen inc mod 2 }
        }
 }

Supported stateful statements are: limit, quota, counter and connlimit.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 src/statement.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'src/statement.c')

diff --git a/src/statement.c b/src/statement.c
index 039ca943..98e56844 100644
--- a/src/statement.c
+++ b/src/statement.c
@@ -630,6 +630,12 @@ static void set_stmt_print(const struct stmt *stmt, struct output_ctx *octx)
 	expr_print(stmt->set.set, octx);
 	nft_print(octx, " { ");
 	expr_print(stmt->set.key, octx);
+	if (stmt->set.stmt) {
+		nft_print(octx, " ");
+		octx->stateless++;
+		stmt_print(stmt->set.stmt, octx);
+		octx->stateless--;
+	}
 	nft_print(octx, " }");
 }
 
@@ -658,6 +664,12 @@ static void map_stmt_print(const struct stmt *stmt, struct output_ctx *octx)
 	expr_print(stmt->map.set, octx);
 	nft_print(octx, " { ");
 	expr_print(stmt->map.key, octx);
+	if (stmt->map.stmt) {
+		nft_print(octx, " ");
+		octx->stateless++;
+		stmt_print(stmt->map.stmt, octx);
+		octx->stateless--;
+	}
 	nft_print(octx, " : ");
 	expr_print(stmt->map.data, octx);
 	nft_print(octx, " }");
-- 
cgit v1.2.3