<html>
<head>
<base href="https://bugzilla.netfilter.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [Feature request] Comments in the element in the set"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1767">1767</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[Feature request] Comments in the element in the set
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>contact@brskt.be
</td>
</tr></table>
<p>
<div>
<pre>Hi there,
I wanted to put comments with the elements by adding them in sets to add more
context and to be able to know where the element comes from.
I found this:
<a href="https://manpages.debian.org/bullseye/nftables/nft.8.en.html#ELEMENTS">https://manpages.debian.org/bullseye/nftables/nft.8.en.html#ELEMENTS</a>
<a href="https://stackoverflow.com/a/77511273">https://stackoverflow.com/a/77511273</a>
But it seems it has not been implemented yet and need some development to do.
For example, let's use these rules:
add set netdev firewall limit_rate_6kpps { type ipv4_addr ; timeout 1s ; size
12000 ; flags timeout, dynamic ; }
add set netdev firewall limit_rate_4mbytes { type ipv4_addr ; timeout 1s ; size
12000 ; flags timeout, dynamic ; }
add set netdev firewall limit_rate { type ipv4_addr ; timeout 1m ; size 24000 ;
flags timeout, dynamic ; }
add rule netdev firewall INPUT update @limit_rate_6kpps { ip daddr limit rate
over 6000/second } add @limit_rate { ip daddr comment from_rule_6kpps }
add rule netdev firewall INPUT update @limit_rate_4mbytes { ip daddr limit rate
over 4 mbytes/second } add @limit_rate { ip daddr comment from_rule_4mbytes }
The comment used for the 'limit_rate' set will be to know from which rule the
element has been added, if it's from the limit rate about the packets or per
byte.
So, when listing the set, it will look like:
table netdev firewall {
set limit_rate {
type ipv4_addr
size 24000
flags dynamic,timeout
timeout 1m
elements = { 1.2.3.4 timeout 1m expires 28s470ms comment
from_rule_6kpps,
5.6.7.8 timeout 1m expires 54s284ms comment
from_rule_4mbytes }
}
}
Of course in this case, thus can also be in the json exportation and maybe used
to, if the comment is unique: add/find/delete elements, it could be for
anything if we insert the element via scripting.
Thanks in advance.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>