Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > NB: This uses {} to separate ct count statement from grouping to
> > avoid shift/reduce conflicts in the parser, unlike fib we do not
> > have distinct 'end marker' available.
>
> If your concern is this {} curly braces, I think that should be fine
> from a semantic point of view.
Ok, good to know.
> From the kernel perspective, I wonder if it would be good to place
> this rbtree that allows us to count in a nftables set, so we can
> create maps that people can flush and that can also populate from
> userspace via API (me thinking of this usecase: userspace software,
> updating reputation ranks for IP addresses based on more heuristics,
> using this new set type, if that makes sense to you, of course).
I will need to think about this. Basically the rbtree is a kludge
because we can't store it in the conntrack table and on-demand counting
of the conntrack table would be way too expensive.
> I understand this might be more work - I haven't seen your patch to
> add nf_conncount to nftables, but I suspect you already made a bit of
> progress - so this turn may trigger some rework.
The current patch is here:
https://git.breakpoint.cc/cgit/fw/nf-next.git/commit/?id=82c931a0f896abf654c961859b9dc5c485f0a033
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
