Stateful objects - Revision history

Fmyhr: Intro: link counter page.

2021-04-06T15:09:01Z

Intro: link counter page.

← Older revision		Revision as of 15:09, 6 April 2021
Line 1:		Line 1:
	''Stateful objects'' is nftables's umbrella term for objects that maintain information about packet flows and connection states, that are updated by each packet that "hits" them, and that share a common syntax. Strictly speaking, ''stateful object'' refers to a '''named''' object that is attached to a [[Configuring_tables\|table]]. More loosely, anonymous stateful objects can also be used, e.g. an unnamed ''counter'' used in a [[Simple_rule_management\|rule]]. Anonymous stateful objects exist only in the context of the object (i.e. rule) in which they are used. This difference in scope causes some quirks, see the below section on resetting stateful objects.		''Stateful objects'' is nftables's umbrella term for objects that maintain information about packet flows and connection states, that are updated by each packet that "hits" them, and that share a common syntax. Strictly speaking, ''stateful object'' refers to a '''named''' object that is attached to a [[Configuring_tables\|table]]. More loosely, anonymous stateful objects can also be used, e.g. an unnamed [[Counters\|counter]] used in a [[Simple_rule_management\|rule]]. Anonymous stateful objects exist only in the context of the object (i.e. rule) in which they are used. This difference in scope causes some quirks, see the below section on resetting stateful objects.

	Initial support for stateful objects was added in [https://kernelnewbies.org/Linux_4.10#Networking Linux kernel 4.10] and [https://marc.info/?l=netfilter&m=150785219810541&w=2 nftables 0.8], with support for counters and quotas.		Initial support for stateful objects was added in [https://kernelnewbies.org/Linux_4.10#Networking Linux kernel 4.10] and [https://marc.info/?l=netfilter&m=150785219810541&w=2 nftables 0.8], with support for counters and quotas.

Fmyhr: Add qualification that stateful objects are updated by each packet that "hits" them.

2021-04-06T15:06:43Z

Add qualification that stateful objects are updated by each packet that "hits" them.

← Older revision		Revision as of 15:06, 6 April 2021
Line 1:		Line 1:
	''Stateful objects'' is nftables's umbrella term for objects that maintain information about packet flows and connection states, and that share a common syntax. Strictly speaking, ''stateful object'' refers to a '''named''' object that is attached to a [[Configuring_tables\|table]]. More loosely, anonymous stateful objects can also be used, e.g. an unnamed ''counter'' used in a [[Simple_rule_management\|rule]]. Anonymous stateful objects exist only in the context of the object (i.e. rule) in which they are used. This difference in scope causes some quirks, see the below section on resetting stateful objects.		''Stateful objects'' is nftables's umbrella term for objects that maintain information about packet flows and connection states, that are updated by each packet that "hits" them, and that share a common syntax. Strictly speaking, ''stateful object'' refers to a '''named''' object that is attached to a [[Configuring_tables\|table]]. More loosely, anonymous stateful objects can also be used, e.g. an unnamed ''counter'' used in a [[Simple_rule_management\|rule]]. Anonymous stateful objects exist only in the context of the object (i.e. rule) in which they are used. This difference in scope causes some quirks, see the below section on resetting stateful objects.

	Initial support for stateful objects was added in [https://kernelnewbies.org/Linux_4.10#Networking Linux kernel 4.10] and [https://marc.info/?l=netfilter&m=150785219810541&w=2 nftables 0.8], with support for counters and quotas.		Initial support for stateful objects was added in [https://kernelnewbies.org/Linux_4.10#Networking Linux kernel 4.10] and [https://marc.info/?l=netfilter&m=150785219810541&w=2 nftables 0.8], with support for counters and quotas.

Fmyhr: Rewrote introduction.

2021-04-04T01:34:11Z

Rewrote introduction.

← Older revision		Revision as of 01:34, 4 April 2021
Line 1:		Line 1:
	~~Since Linux Kernel 4~~.~~10 and nft v0~~.~~8 nftables supports~~ stateful objects.		''Stateful objects'' is nftables's umbrella term for objects that maintain information about packet flows and connection states, and that share a common syntax. Strictly speaking, ''stateful object'' refers to a '''named''' object that is attached to a [[Configuring_tables\|table]]. More loosely, anonymous stateful objects can also be used, e.g. an unnamed ''counter'' used in a [[Simple_rule_management\|rule]]. Anonymous stateful objects exist only in the context of the object (i.e. rule) in which they are used. This difference in scope causes some quirks, see the below section on resetting stateful objects.

	~~Stateful~~ objects ~~group stateful information of rules~~, ~~the supported types are: '''~~counters~~'''~~ and ~~'''~~quotas~~'''. Stateful objects are attached to tables and have a unique name, defined by the user~~.		Initial support for stateful objects was added in [https://kernelnewbies.org/Linux_4.10#Networking Linux kernel 4.10] and [https://marc.info/?l=netfilter&m=150785219810541&w=2 nftables 0.8], with support for counters and quotas.

	= Creating stateful objects =		= Creating stateful objects =

Arturo: /* Listing stateful objects */ add more quota examples

2020-07-21T13:34:22Z

Listing stateful objects: add more quota examples

@@ Line 86: / Line 86: @@
+	}
+}
 </source>
@@ Line 92: / Line 100: @@
 <source lang="bash">
 % nft list quotas
 </source>
@@ Line 123: / Line 144: @@
 	counter mycounter2 {
 		packets 0 bytes 0
+	}
+}

Arturo: /* Listing stateful objects */ extend examples

2020-07-21T13:30:34Z

Listing stateful objects: extend examples

@@ Line 81: / Line 81: @@
 <source lang="bash">
 % nft list counter filter https-traffic
 </source>
-Also, it's possible to list all stateful objects of the same type:
+Also, it's possible to list all stateful objects of the same type. Example with quotas:
 <source lang="bash">
@@ Line 89: / Line 94: @@
 </source>
-And list all stateful objects of a type in a table:
+Example with counters:
 <source lang="bash">
-% nft list counters table filter
+% nft list counters
 </source>

Arturo: /* Creating stateful objects */ be more precise

2020-07-21T13:23:02Z

Creating stateful objects: be more precise

← Older revision		Revision as of 13:23, 21 July 2020
Line 12:		Line 12:
	</source>		</source>

	These rules create a table named ''filter'', then a '''stateful counter''' named ''https-traffic'' and attaches it to ''filter''.		These rules create a table named ''filter'', then a '''stateful counter''' named ''https-traffic'' and attaches it to the ''filter'' table.

	Creating a '''quota''' is similar:		Creating a '''quota''' is similar:

Arturo: more bolding

2020-07-21T13:22:34Z

more bolding

← Older revision		Revision as of 13:22, 21 July 2020
Line 1:		Line 1:
	Since Linux Kernel 4.10 and nft v0.8 nftables supports stateful objects.		Since Linux Kernel 4.10 and nft v0.8 nftables supports stateful objects.

	Stateful objects group stateful information of rules, the supported types are: counters and quotas. Stateful objects are attached to tables and have a unique name, defined by the user.		Stateful objects group stateful information of rules, the supported types are: '''counters''' and '''quotas'''. Stateful objects are attached to tables and have a unique name, defined by the user.

	= Creating stateful objects =		= Creating stateful objects =

Arturo: /* Creating stateful objects */ add some bolding

2020-07-21T13:20:23Z

Creating stateful objects: add some bolding

← Older revision		Revision as of 13:20, 21 July 2020
Line 5:		Line 5:
	= Creating stateful objects =		= Creating stateful objects =

	You can create a counter with the ~~command~~:		You can create a '''stateful counter''' with the following commands:

	<source lang="bash">		<source lang="bash">
Line 12:		Line 12:
	</source>		</source>

	These rules create a table named ''filter'', then a counter named ''https-traffic'' and attaches it to ''filter''.		These rules create a table named ''filter'', then a '''stateful counter''' named ''https-traffic'' and attaches it to ''filter''.

	Creating a quota is similar:		Creating a '''quota''' is similar:

	<source lang="bash">		<source lang="bash">

Dlakeland: /* Resetting stateful objects */

2019-01-10T17:55:57Z

Resetting stateful objects

← Older revision		Revision as of 17:55, 10 January 2019
Line 121:		Line 121:
	% nft reset quotas table filter		% nft reset quotas table filter
	</source>		</source>

			At the moment (Jan 2019) resetting quotas does not reset anonymous quotas such as used in rules without names, see [https://bugzilla.netfilter.org/show_bug.cgi?id=1314 bug #1314]

Dlakeland: /* Referencing stateful objects in rules */

2019-01-10T17:46:42Z

Referencing stateful objects in rules

← Older revision		Revision as of 17:46, 10 January 2019
Line 66:		Line 66:
	chain dropafterquota {		chain dropafterquota {
	type filter hook postrouting priority 0; policy accept;		type filter hook postrouting priority 0; policy accept;
	udp port 5060 quota example drop		udp port 5060 quota name "example" drop
	}		}