151 lines
4.4 KiB
Diff
151 lines
4.4 KiB
Diff
From 0db42cc2d2647ec61441e29445c9f6e0f8946613 Mon Sep 17 00:00:00 2001
|
|
From: Phil Sutter <psutter@redhat.com>
|
|
Date: Thu, 13 Jan 2022 20:37:56 +0100
|
|
Subject: [PATCH] src: support for restoring element counters
|
|
|
|
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2039594
|
|
Upstream Status: nftables commit 1fe6089ddd87e
|
|
|
|
commit 1fe6089ddd87ee7869d24c0f8849951220cc9b85
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Wed Mar 11 13:00:01 2020 +0100
|
|
|
|
src: support for restoring element counters
|
|
|
|
This patch allows you to restore counters in dynamic sets:
|
|
|
|
table ip test {
|
|
set test {
|
|
type ipv4_addr
|
|
size 65535
|
|
flags dynamic,timeout
|
|
timeout 30d
|
|
gc-interval 1d
|
|
elements = { 192.168.10.13 expires 19d23h52m27s576ms counter packets 51 bytes 17265 }
|
|
}
|
|
chain output {
|
|
type filter hook output priority 0;
|
|
update @test { ip saddr }
|
|
}
|
|
}
|
|
|
|
You can also add counters to elements from the control place, ie.
|
|
|
|
table ip test {
|
|
set test {
|
|
type ipv4_addr
|
|
size 65535
|
|
elements = { 192.168.2.1 counter packets 75 bytes 19043 }
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter; policy accept;
|
|
ip daddr @test
|
|
}
|
|
}
|
|
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
---
|
|
include/netlink.h | 1 +
|
|
src/netlink.c | 3 +++
|
|
src/netlink_linearize.c | 2 +-
|
|
src/parser_bison.y | 36 +++++++++++++++++++++++++++++++++++-
|
|
4 files changed, 40 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/include/netlink.h b/include/netlink.h
|
|
index 88d12ba..059092e 100644
|
|
--- a/include/netlink.h
|
|
+++ b/include/netlink.h
|
|
@@ -97,6 +97,7 @@ extern void netlink_gen_data(const struct expr *expr,
|
|
extern void netlink_gen_raw_data(const mpz_t value, enum byteorder byteorder,
|
|
unsigned int len,
|
|
struct nft_data_linearize *data);
|
|
+extern struct nftnl_expr *netlink_gen_stmt_stateful(const struct stmt *stmt);
|
|
|
|
extern struct expr *netlink_alloc_value(const struct location *loc,
|
|
const struct nft_data_delinearize *nld);
|
|
diff --git a/src/netlink.c b/src/netlink.c
|
|
index 64e51e5..825c2cc 100644
|
|
--- a/src/netlink.c
|
|
+++ b/src/netlink.c
|
|
@@ -136,6 +136,9 @@ static struct nftnl_set_elem *alloc_nftnl_setelem(const struct expr *set,
|
|
if (elem->expiration)
|
|
nftnl_set_elem_set_u64(nlse, NFTNL_SET_ELEM_EXPIRATION,
|
|
elem->expiration);
|
|
+ if (elem->stmt)
|
|
+ nftnl_set_elem_set(nlse, NFTNL_SET_ELEM_EXPR,
|
|
+ netlink_gen_stmt_stateful(elem->stmt), 0);
|
|
if (elem->comment || expr->elem_flags) {
|
|
udbuf = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
|
|
if (!udbuf)
|
|
diff --git a/src/netlink_linearize.c b/src/netlink_linearize.c
|
|
index f5c6116..3fa1339 100644
|
|
--- a/src/netlink_linearize.c
|
|
+++ b/src/netlink_linearize.c
|
|
@@ -838,7 +838,7 @@ static struct nftnl_expr *netlink_gen_quota_stmt(const struct stmt *stmt)
|
|
return nle;
|
|
}
|
|
|
|
-static struct nftnl_expr *netlink_gen_stmt_stateful(const struct stmt *stmt)
|
|
+struct nftnl_expr *netlink_gen_stmt_stateful(const struct stmt *stmt)
|
|
{
|
|
switch (stmt->ops->type) {
|
|
case STMT_CONNLIMIT:
|
|
diff --git a/src/parser_bison.y b/src/parser_bison.y
|
|
index d38ec30..2cdf8ec 100644
|
|
--- a/src/parser_bison.y
|
|
+++ b/src/parser_bison.y
|
|
@@ -3654,7 +3654,7 @@ meter_key_expr_alloc : concat_expr
|
|
;
|
|
|
|
set_elem_expr : set_elem_expr_alloc
|
|
- | set_elem_expr_alloc set_elem_options
|
|
+ | set_elem_expr_alloc set_elem_expr_options
|
|
;
|
|
|
|
set_elem_expr_alloc : set_lhs_expr
|
|
@@ -3684,6 +3684,40 @@ set_elem_option : TIMEOUT time_spec
|
|
}
|
|
;
|
|
|
|
+set_elem_expr_options : set_elem_expr_option
|
|
+ {
|
|
+ $<expr>$ = $<expr>0;
|
|
+ }
|
|
+ | set_elem_expr_options set_elem_expr_option
|
|
+ ;
|
|
+
|
|
+set_elem_expr_option : TIMEOUT time_spec
|
|
+ {
|
|
+ $<expr>0->timeout = $2;
|
|
+ }
|
|
+ | EXPIRES time_spec
|
|
+ {
|
|
+ $<expr>0->expiration = $2;
|
|
+ }
|
|
+ | COUNTER
|
|
+ {
|
|
+ $<expr>0->stmt = counter_stmt_alloc(&@$);
|
|
+ }
|
|
+ | COUNTER PACKETS NUM BYTES NUM
|
|
+ {
|
|
+ struct stmt *stmt;
|
|
+
|
|
+ stmt = counter_stmt_alloc(&@$);
|
|
+ stmt->counter.packets = $3;
|
|
+ stmt->counter.bytes = $5;
|
|
+ $<expr>0->stmt = stmt;
|
|
+ }
|
|
+ | comment_spec
|
|
+ {
|
|
+ $<expr>0->comment = $1;
|
|
+ }
|
|
+ ;
|
|
+
|
|
set_lhs_expr : concat_rhs_expr
|
|
| wildcard_expr
|
|
;
|
|
--
|
|
2.31.1
|
|
|