nftables: nf_acct and quota support ?

nftables: nf_acct and quota support ?

[jalvarez]

Hi,

I am currently trying to add quotas for traffic that matches some 
nftables rules.
While looking for a solution I have found the netfiler accounting 
infrastructure (nfacct) very interesting.
Problem is I didn't find anything about nfacct in the nftables code.

Is there any nftables support (or planned support) for nfacct ?

If there is not, is it "safe" to use some iptables rules in the FORWARD 
chain to trigger the accounting after nftables chains (with a priority < 
NF_IP_PRI_FILTER) performed the real packet filtering stuff ?

Thanks a lot :)

Re: nftables: nf_acct and quota support ?

[Pablo Neira Ayuso]

On Wed, Aug 03, 2016 at 04:06:09PM +0200, jalvarez wrote:
> Hi,
> 
> I am currently trying to add quotas for traffic that matches some nftables
> rules.
> While looking for a solution I have found the netfiler accounting
> infrastructure (nfacct) very interesting.
> Problem is I didn't find anything about nfacct in the nftables code.
> 
> Is there any nftables support (or planned support) for nfacct ?

I have a patchset that I need to spin over again, but it's coming with
native support for nftables.

Re: nftables: nf_acct and quota support ?

[jalvarez]

On 10/08/2016 14:34, Pablo Neira Ayuso wrote:

> On Wed, Aug 03, 2016 at 04:06:09PM +0200, jalvarez wrote:
>> Hi,
>>
>> I am currently trying to add quotas for traffic that matches some nftables
>> rules.
>> While looking for a solution I have found the netfiler accounting
>> infrastructure (nfacct) very interesting.
>> Problem is I didn't find anything about nfacct in the nftables code.
>>
>> Is there any nftables support (or planned support) for nfacct ?
> I have a patchset that I need to spin over again, but it's coming with
> native support for nftables.
Ok ! Are you refering to Ana Rey Botello's patchset ? 
http://www.spinics.net/lists/netfilter-devel/msg34766.html
I looked very promising ! :)

In the end, do you think the following features could be added in nftables ?
- an expression to increment nfacct counters (maybe reusing the existing 
semantic "counter xxx").
- an expression to match if the quota set on the nfacct object is 
exceeded. Something like : "counter name xxx overquota".

This could lead to interesting things like starting to drop packets when 
a quota is exceeded.

Thanks.

Re: nftables: nf_acct and quota support ?

[Pablo Neira Ayuso]

On Wed, Aug 10, 2016 at 03:14:38PM +0200, jalvarez wrote:
> In the end, do you think the following features could be added in nftables ?
> - an expression to increment nfacct counters (maybe reusing the existing
> semantic "counter xxx").
> - an expression to match if the quota set on the nfacct object is exceeded.
> Something like : "counter name xxx overquota".
> 
> This could lead to interesting things like starting to drop packets when a
> quota is exceeded.

Yes, quota support is also included. And similar semantics to nfacct
will be retained.