Eric Lee / smarc-fsl-linux-kernel

11 Nov, 2015

1 commit

14 Apr, 2015

1 commit

  • 3e135cd49   netfilter: nft_dynset: dynamic stateful expression instantiation ... Browse Code »

    Support instantiating stateful expressions based on a template that
    are associated with dynamically created set entries. The expressions
    are evaluated when adding or updating the set element.

    This allows to maintain per flow state using the existing set
    infrastructure and expression types, with arbitrary definitions of
    a flow.

    Usage is currently restricted to anonymous sets, meaning only a single
    binding can exist, since the desired semantics of multiple independant
    bindings haven't been defined so far.

    Examples (userspace syntax is still WIP):

    1. Limit the rate of new SSH connections per host, similar to iptables
    hashlimit:

    flow ip saddr timeout 60s \
    limit 10/second \
    accept

    2. Account network traffic between each set of /24 networks:

    flow ip saddr & 255.255.255.0 . ip daddr & 255.255.255.0 \
    counter

    3. Account traffic to each host per user:

    flow skuid . ip daddr \
    counter

    4. Account traffic for each combination of source address and TCP flags:

    flow ip saddr . tcp flags \
    counter

    The resulting set content after a Xmas-scan look like this:

    {
    192.168.122.1 . fin | psh | urg : counter packets 1001 bytes 40040,
    192.168.122.1 . ack : counter packets 74 bytes 3848,
    192.168.122.1 . psh | ack : counter packets 35 bytes 3144
    }

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy
     

13 Apr, 2015

3 commits

08 Apr, 2015

1 commit

  • 22fe54d5f   netfilter: nf_tables: add support for dynamic set updates ... Browse Code »

    Add a new "dynset" expression for dynamic set updates.

    A new set op ->update() is added which, for non existant elements,
    invokes an initialization callback and inserts the new element.
    For both new or existing elements the extenstion pointer is returned
    to the caller to optionally perform timer updates or other actions.

    Element removal is not supported so far, however that seems to be a
    rather exotic need and can be added later on.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Pablo Neira Ayuso

    Patrick McHardy