On Mon, Jan 15, 2018 at 11:46:39AM +0100, Pablo Neira Ayuso wrote:
> Hi Florian,
>
> On Fri, Jan 12, 2018 at 02:41:11PM +0100, Florian Westphal wrote:
> > This adds support for a native connlimit replacement.
> >
> > It re-uses nftables concatenation support and thus allows
> > using any key combinations supported by nftables.
> >
> > Because counting is expensive, it is useful to limit this
> > to new connections only. Example:
> >
> > ct state new ct count { ip saddr . tcp dport } gt 10 drop
> >
> > TODO: man page entry.
> >
> > NB: This uses {} to separate ct count statement from grouping to
> > avoid shift/reduce conflicts in the parser, unlike fib we do not
> > have distinct 'end marker' available.
>
> If your concern is this {} curly braces, I think that should be fine
> from a semantic point of view.
Extending this sentence: I'm telling this because my understanding is
that the behaviour of this feature is basically to add elements to an
anonymous set - that is represented through a rb-tree on the backend
side.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
