Re: [PATCH RFC nft] src: ct: add connection counting support

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > NB: This uses {} to separate ct count statement from grouping to
> > avoid shift/reduce conflicts in the parser, unlike fib we do not
> > have distinct 'end marker' available.
> 
> If your concern is this {} curly braces, I think that should be fine
> from a semantic point of view.

Ok, good to know.

> From the kernel perspective, I wonder if it would be good to place
> this rbtree that allows us to count in a nftables set, so we can
> create maps that people can flush and that can also populate from
> userspace via API (me thinking of this usecase: userspace software,
> updating reputation ranks for IP addresses based on more heuristics,
> using this new set type, if that makes sense to you, of course).

I will need to think about this.  Basically the rbtree is a kludge
because we can't store it in the conntrack table and on-demand counting
of the conntrack table would be way too expensive.

> I understand this might be more work - I haven't seen your patch to
> add nf_conncount to nftables, but I suspect you already made a bit of
> progress - so this turn may trigger some rework.

The current patch is here:

https://git.breakpoint.cc/cgit/fw/nf-next.git/commit/?id=82c931a0f896abf654c961859b9dc5c485f0a033