Target hits metrics

[LionelJouin]

Description

Collect number of packets and bytes for each target. Metrics are collected based on nftables metrics on postrouting rules matching target identifier (fwmark).

Example of the new nftables table with 3 targets:

table inet meridio-metrics { # handle 1
        chain target-hits { # handle 1
                type filter hook postrouting priority -500; policy accept;
                meta mark 0x000013c3 counter packets 255 bytes 13668 # handle 2
                meta mark 0x000013d2 counter packets 310 bytes 16616 # handle 3
                meta mark 0x000013da counter packets 260 bytes 13936 # handle 4
        }
}

Issue link

#428
#419

Checklist

• Purpose
  • Bug fix
  • New functionality
  • Documentation
  • Refactoring
  • CI
• Test
  • Unit test
  • E2E Test
  • Tested manually
• Introduce a breaking change
  • Yes (description required)
  • No

[LionelJouin]

/reverify

[LionelJouin]

/reverify

[LionelJouin]

/reverify

[LionelJouin]

/reverify

[zolug]

Try using verdict maps to minimize performance impact that would otherwise arise when number of targets increases.

e.g.:

table inet meridio-metrics {
    map mydict {
        type mark : verdict
        elements = { 0x000013b3 : jump chain-5043, 0x000013b8 : jump chain-5048, 0x000013c7 : jump chain-5063, 0x000013e7 : jump chain-5095 }
    }

    chain nfqlb {
        type filter hook postrouting priority filter; policy accept;
        meta mark vmap @mydict
    }

    chain chain-5095 {
        counter packets 13 bytes 1092
    }

    chain chain-5043 {
        counter packets 0 bytes 0
    }

    chain chain-5063 {
        counter packets 0 bytes 0
    }

    chain chain-5048 {
        counter packets 0 bytes 0
    }
}
~ $ 
~ $ 
~ $ ip rule
0:  from all lookup local
96: from all fwmark 0x13e7 lookup 5095
97: from all fwmark 0x13b3 lookup 5043
98: from all fwmark 0x13c7 lookup 5063
99: from all fwmark 0x13b8 lookup 5048
100:    from 20.0.0.1 lookup 4096
100:    from 40.0.0.0/24 lookup 4096
101:    from 20.0.0.1 lookup 4097
101:    from 40.0.0.0/24 lookup 4097
32766:  from all lookup main
32767:  from all lookup default

nft add table inet meridio-metrics
nft add map inet meridio-metrics mydict { type mark : verdict\; }
nft 'add chain inet meridio-metrics nfqlb { type filter hook postrouting priority filter ; }'
nft add rule inet meridio-metrics nfqlb mark vmap @mydict

nft add rule inet meridio-metrics chain-5095 counter
nft add chain inet meridio-metrics chain-5095
nft add element inet meridio-metrics mydict { 5095 : jump chain-5095 }
...

[LionelJouin]

/reverify

[LionelJouin]

/reverify

[zolug]

In general would be nice wrapping the errors to please wrapcheck.