F32 nftables hiccups

[ja <ja@xxxxxxxxxx>]

I have been attempting to use nft/nftables
to blacklist ssh connections and have come across
two problems.

nftables-0.9.3-3.fc32.x86_64
kernel-5.7.8-200.fc32.x86_64

1. The "limit rate" syntax does not work correctly unless
   the "burst" value is set.
   counter add @saddr_rate { ip saddr timeout 2m limit rate over 4/minute burst 1 packets} counter \
   update @saddr_blacklist { ip saddr timeout 10m } counter drop
    
2. The following syntax is not accepted by nft
   update @connection_count { ip saddr ct count over 3 } \
   add @saddr_blacklist { ip  saddr timeout 1m } drop
		
nft_harting.nft:80:3-52: Error: Could not process rule: Operation not supported
		update @connection_count { ip saddr ct count over 3 } \
		^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I have been following a Debian mail list (amongst many)
https://unix.stackexchange.com/questions/581964/create-dynamic-blacklist-with-nftables/582290#582290
which implies that both of the above should work with the kernel/nft F32 versions installed.

I attach the output of nft list ruleset
(with the offending rule "{ ip saddr ct count over 3 }" commented out)
(It includes the "set" definitions used above)

Can anyone see any deliberate mistakes?

John

root@harting:~]$ nft list ruleset
table ip ja_harting {
        set saddr_blacklist {
                type ipv4_addr
                size 65536
                flags dynamic,timeout
                timeout 10m
        }

        set saddr_rate {
                type ipv4_addr
                size 65536
                flags dynamic,timeout
                timeout 1m
        }

        set connection_count {
                type ipv4_addr
                size 65536
                flags dynamic
        }

        chain SSH_IN {
                ip saddr @saddr_blacklist update @saddr_blacklist { ip saddr timeout 1m } counter packets 1 bytes 60 drop
                counter packets 4 bytes 240 add @saddr_rate { ip saddr timeout 2m limit rate over 4/minute burst 1 packets } counter packets 1 bytes 60 update @saddr_blacklist { ip saddr timeout 10m } counter packets 1 bytes 60 drop
                ct state invalid drop
                counter packets 3 bytes 180 accept
        }

        chain filter_INPUT {
                type filter hook input priority filter + 10; policy accept;
                iifname "lo" counter packets 26 bytes 2847 accept comment "white list local connections, established or not"
                tcp dport 22 ct state new counter packets 5 bytes 300 goto SSH_IN comment "This does not return!"
                tcp dport 22 counter packets 24886 bytes 1305859
                ct state { invalid } drop
                ct state { established, related } counter packets 366030 bytes 270962493 accept
                udp dport 631 ct state { new, untracked } counter packets 2397 bytes 804593 accept comment "CUPS"
                udp dport 8612 ct state { new, untracked } counter packets 0 bytes 0 accept comment "Canon bonjour port"
                reject with icmp type admin-prohibited
        }

        chain filter_FORWARD {
                type filter hook forward priority filter + 10; policy drop;
                reject with icmp type admin-prohibited
        }

        chain filter_OUTPUT {
                type filter hook output priority filter + 10; policy accept;
        }
}
table netdev filter {
        chain ingress {
                type filter hook ingress device "eth0" priority filter; policy accept;
                meta protocol { 0x7374, 0x7380, 0x7475, 0x7679, 0x8137, 0x8138 } counter packets 13136 bytes 629558 drop
        }
}

_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx