[Bug 1185] counter flag proposal for sets and maps

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1185

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> ---
Hi Karel,

We can add something like this:

table x {
    chain y {
         ...
         map m {
                type ipv4_addr . type ipv4_addr : counter;
         }

         map add @m { ip saddr . ip daddr : counter }
}

This would populate the map 'm' with entries whose keys are the 'ip saddr . ip
daddr' tuple, where each entry gets a counter.

The idea is that you can use the usual command:

    nft list map x y

as well as any other existing map operations.

The double 'counter' above is a bit redundant, but we could use any stateful
object instead with its parameters, eg.

table x {
    chain y {
         ...
         map m {
                type ipv4_addr : quota;
         }

         map add @m { ip saddr : quota 10 mbytes } accept
}

In this case, we can populate 'm' via different rules, that add different quota
policies.

Is this close to you would like to see in place?

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20171002/38c44219/attachment.html>