Open saushew opened 2 months ago
I don't know if we do this, but could you add this description to commit message too?
I like the idea of tagging dumps and customizable counters but there are some points about:
ipfw
syntax despite the fact that we agreed to extend themSo let us to set the PR on hold at least until the non-terminating rules design makes clear.
This pull request aims to enhance
YANET's
ACL counters feature by implementing support for a new type of rule syntax inspired byIPFW
. The proposed enhancement allows for more accurate tracking of active rules by associating counters with specific rule entries.The current implementation of ACL counters in
YANET
has a notable limitation where intersecting rules may lead to false positive conclusions about rule activity. This limitation arises due to the top-down packet firewall rule lookup process, where only the counter of the terminating rule is incremented.To address this issue, this pull request introduces support for rules of the form
add count:counter_name
, allowing administrators to specify a counter name associated with each rule. By associating counters directly with rules, we ensure that counters accurately reflect rule activity, even in cases of rule intersections.Key Changes:
add count:counter_name