On Mon, Jan 15, 2018 at 11:59:47AM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > > NB: This uses {} to separate ct count statement from grouping to
> > > avoid shift/reduce conflicts in the parser, unlike fib we do not
> > > have distinct 'end marker' available.
> >
> > If your concern is this {} curly braces, I think that should be fine
> > from a semantic point of view.
>
> Ok, good to know.
>
> > From the kernel perspective, I wonder if it would be good to place
> > this rbtree that allows us to count in a nftables set, so we can
> > create maps that people can flush and that can also populate from
> > userspace via API (me thinking of this usecase: userspace software,
> > updating reputation ranks for IP addresses based on more heuristics,
> > using this new set type, if that makes sense to you, of course).
>
> I will need to think about this.
This is more than what iptables is doing, of course. But now that
we're on this, we have a chance to re-think if it makes sense to
leverage this infrastructure in nftables.
> Basically the rbtree is a kludge because we can't store it in the
> conntrack table and on-demand counting of the conntrack table would
> be way too expensive.
I see, actually we could even place this in a hashtable instead,
right? Not asking you to do this, just thinking aloud here.
> > I understand this might be more work - I haven't seen your patch to
> > add nf_conncount to nftables, but I suspect you already made a bit of
> > progress - so this turn may trigger some rework.
>
> The current patch is here:
>
> https://git.breakpoint.cc/cgit/fw/nf-next.git/commit/?id=82c931a0f896abf654c961859b9dc5c485f0a033
That's very much done work already, sorry I didn't rise this any
sooner.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
