Hi Florian,
On Fri, Jan 12, 2018 at 02:41:11PM +0100, Florian Westphal wrote:
> This adds support for a native connlimit replacement.
>
> It re-uses nftables concatenation support and thus allows
> using any key combinations supported by nftables.
>
> Because counting is expensive, it is useful to limit this
> to new connections only. Example:
>
> ct state new ct count { ip saddr . tcp dport } gt 10 drop
>
> TODO: man page entry.
>
> NB: This uses {} to separate ct count statement from grouping to
> avoid shift/reduce conflicts in the parser, unlike fib we do not
> have distinct 'end marker' available.
If your concern is this {} curly braces, I think that should be fine
from a semantic point of view.
>From the kernel perspective, I wonder if it would be good to place
this rbtree that allows us to count in a nftables set, so we can
create maps that people can flush and that can also populate from
userspace via API (me thinking of this usecase: userspace software,
updating reputation ranks for IP addresses based on more heuristics,
using this new set type, if that makes sense to you, of course).
I understand this might be more work - I haven't seen your patch to
add nf_conncount to nftables, but I suspect you already made a bit of
progress - so this turn may trigger some rework.
Let me know, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
