Re: [PATCH nft 7/7] nft: add flow statement

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Apr 27, 2016 at 12:29:50PM +0100, Patrick McHardy wrote:
> The flow statement allows to instantiate per flow statements for user
> defined flows. This can so far be used for per flow accounting or limiting,
> similar to what the iptables hashlimit provides. Flows can be aged using
> the timeout option.
> 
> Examples:
> 
> # nft filter input flow ip saddr . tcp dport limit rate 10/second
> # nft filter input flow table acct iif . ip saddr timeout 60s counter

I think you have to update this syntax to:

# nft add rule filter input \
        flow { ip saddr . tcp dport limit rate 10/second }
             ^                                           ^

# nft add rule filter input \
        flow table acct { iif . ip saddr timeout 60s counter }
                        ^                                    ^

so the idea is to wrap this around brackets.

When playing around with this in your initial patchset I found very
confusing that it may not look obvious to users that they can only use
one single statement.

For example:

# nft add rule filter input \
        flow table acct iif . ip saddr timeout 60s counter limit rate 10/second
                                                           ~~~~~~~~~~~~~~~~~~~~

Note that this limit rate applies globally.

This may cause us problems in the future too if we extend this to
support more than one single statement per flowtable entry (Not
telling we need this now, but if someone comes up with a useful
usecase, we should be capable of extending this).