diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-05-31 18:08:06 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2018-06-06 15:49:47 +0200 |
commit | 57e4a095edc4dab19e14fc8d1bca3febde1ca86c (patch) | |
tree | c51aaa1f1d3a6d1b42d2ee3da073b46289524ea5 /include/statement.h | |
parent | 3384849c113b1ec3906c7a22cc71d708aae1218e (diff) |
src: connlimit support
This patch adds support for the new connlimit stateful expression, that
provides a mapping with the connlimit iptables extension through meters.
eg.
nft add rule filter input tcp dport 22 \
meter test { ip saddr ct count over 2 } counter reject
This limits the maximum amount incoming of SSH connections per source
address up to 2 simultaneous connections.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'include/statement.h')
-rw-r--r-- | include/statement.h | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/include/statement.h b/include/statement.h index de26549b..d4bcaf3a 100644 --- a/include/statement.h +++ b/include/statement.h @@ -25,6 +25,13 @@ struct objref_stmt { const char *objref_type_name(uint32_t type); struct stmt *objref_stmt_alloc(const struct location *loc); +struct connlimit_stmt { + uint32_t count; + uint32_t flags; +}; + +extern struct stmt *connlimit_stmt_alloc(const struct location *loc); + struct counter_stmt { uint64_t packets; uint64_t bytes; @@ -247,6 +254,7 @@ extern struct stmt *xt_stmt_alloc(const struct location *loc); * @STMT_OBJREF: stateful object reference statement * @STMT_EXTHDR: extension header statement * @STMT_FLOW_OFFLOAD: flow offload statement + * @STMT_CONNLIMIT: connection limit statement * @STMT_MAP: map statement */ enum stmt_types { @@ -272,6 +280,7 @@ enum stmt_types { STMT_OBJREF, STMT_EXTHDR, STMT_FLOW_OFFLOAD, + STMT_CONNLIMIT, STMT_MAP, }; @@ -318,6 +327,7 @@ struct stmt { struct expr *expr; struct exthdr_stmt exthdr; struct meter_stmt meter; + struct connlimit_stmt connlimit; struct counter_stmt counter; struct payload_stmt payload; struct meta_stmt meta; |