From b8f8ddfff7335d3a8bebf5d85085974ae36f4099 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 6 Mar 2024 17:48:58 +0100 Subject: evaluate: translate meter into dynamic set 129f9d153279 ("nft: migrate man page examples with `meter` directive to sets") already replaced meters by dynamic sets. This patch removes NFT_SET_ANONYMOUS flag from the implicit set that is instantiated via meter, so the listing shows a dynamic set instead which is the recommended approach these days. Therefore, a batch like this: add table t add chain t c add rule t c tcp dport 80 meter m size 128 { ip saddr timeout 1s limit rate 10/second } gets translated to a dynamic set: table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } chain c { tcp dport 80 update @m { ip saddr timeout 1s limit rate 10/second burst 5 packets } } } Check for NFT_SET_ANONYMOUS flag is also relaxed for list and flush meter commands: # nft list meter ip t m table ip t { set m { type ipv4_addr size 128 flags dynamic,timeout } } # nft flush meter ip t m As a side effect the legacy 'list meter' and 'flush meter' commands allow to flush a dynamic set to retain backward compatibility. This patch updates testcases/sets/0022type_selective_flush_0 and testcases/sets/0038meter_list_0 as well as the json output which now uses the dynamic set representation. Signed-off-by: Pablo Neira Ayuso --- tests/shell/testcases/sets/dumps/0038meter_list_0.nft | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'tests/shell/testcases/sets/dumps/0038meter_list_0.nft') diff --git a/tests/shell/testcases/sets/dumps/0038meter_list_0.nft b/tests/shell/testcases/sets/dumps/0038meter_list_0.nft index f274086b..8037dfa5 100644 --- a/tests/shell/testcases/sets/dumps/0038meter_list_0.nft +++ b/tests/shell/testcases/sets/dumps/0038meter_list_0.nft @@ -5,7 +5,13 @@ table ip t { flags dynamic,timeout } + set m { + type ipv4_addr + size 128 + flags dynamic + } + chain c { - tcp dport 80 meter m size 128 { ip saddr limit rate 10/second burst 5 packets } + tcp dport 80 add @m { ip saddr limit rate 10/second burst 5 packets } } } -- cgit v1.2.3